The vulnerability resides in the UEditor component of erzhongxmu JEEWMS, specifically the getContent.jsp script. An attacker can manipulate the myEditor argument supplied to this endpoint, which results in reflected cross site scripting. The flaw is a classic example of CWE‑79, with a secondary indication of CWE‑94 suggesting potential code evaluation issues. If an attacker injects malicious JavaScript, it will execute in the context of any user who visits the affected page.

Vendors erzhongxmu and product JEEWMS are impacted. The flaw exists in all releases up to and including version 3.7. No specific sub‑versions are listed, so any installation of JEEWMS 3.7 or earlier should be considered vulnerable.

The CVSS score of 5.3 places the risk in the moderate range, and the EPSS score of less than 1 % indicates a low probability of exploitation in the current landscape, though it is not zero. The vulnerability is not listed in the CISA KEV catalog. The exploit can be launched remotely through a crafted request to the getContent.jsp URL, with no authentication required. The likely attack vector is a reflected XSS delivered via the myEditor parameter to a victim’s browser. Once the script runs, an attacker could perform actions such as session hijacking, defacement, or phishing, depending on the privileges of the victim.