A weakness in erzhongxmu JEEWMS allows an attacker to inject arbitrary SQL through the CommonServiceImpl.getAutoList method. The vulnerability originates from unsanitized input parameters trem, searchField, and entityName in the Autocomplete handler, enabling unauthorized data manipulation. Successful exploitation can lead to data exposure, alteration, or deletion, affecting confidentiality and integrity of the database.

The flaw affects erzhongxmu JEEWMS versions up to 2026.09.27‑W39, including all earlier releases. Systems running this software without updates are susceptible.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is listed in public exploit databases, and the attacker can target it remotely, indicating a realistic risk. Although not yet catalogued in CISA KEV, the presence of a publicly available exploit lowers the threshold for attack.