The vulnerability is a stored cross‑site scripting flaw in the doAdd method of JeecgListDemoController. The Name parameter is not sanitized, allowing an attacker to embed malicious JavaScript that will be executed in the browser of any user who views the affected page. This can lead to session hijacking, defacement, or execution of arbitrary code within the victim’s browser context.

It affects the JEEWMS product from the vendor erzhongxmu, in all releases up to and including version 3.7. The vulnerability is present in the source file src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java. No specific product versions beyond 3.7 are listed; administrators should verify whether their deployment falls within this range.

The CVSS score is 5.3, indicating a moderate impact if exploited. The EPSS score is below 1%, pointing to a low likelihood of widespread exploitation at this time. The vulnerability can be triggered remotely by submitting a crafted Name value; there is no indication of an additional vulnerability such as code injection (CWE‑94) being necessary to exploit it. The issue is not yet listed in the CISA Known Exploited Vulnerabilities catalogue, but the vendor has not released a fix, so the risk remains until remediation or a patch is applied.