PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108684 erzhongxmu CVE debrief

A SQL injection vulnerability was detected in erzhongxmu Jeewms up to 3.7, affecting the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeewmsFormDemoController.java of the component Autocomplete Data Handler. The attack can be initiated remotely. This vulnerability requires defenders to assess exposure and apply the patch to prevent SQL injection attacks. The CVE record and source item provide details on the SQL injection vulnerability in erzhongxmu Jeewms up to 3.7.

Vendor
erzhongxmu
Product
Jeewms
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders of systems using erzhongxmu Jeewms up to 3.7 should assess exposure and apply the patch to prevent SQL injection attacks. This includes operators, administrators, and security teams responsible for managing and securing systems that use erzhongxmu Jeewms up to 3.7.

Why it matters

The SQL injection vulnerability in erzhongxmu Jeewms up to 3.7 requires defenders to assess exposure and apply the patch to prevent remote attacks.

  • Verify and apply patch 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 to prevent SQL injection
  • Restrict access to the Autocomplete Data Handler to prevent remote attacks
  • Monitor for suspicious activity to detect potential exploitation

Technical summary

The SQL injection vulnerability in erzhongxmu Jeewms up to 3.7 affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. The attack can be initiated remotely. This vulnerability requires defenders to assess exposure and apply the patch to prevent SQL injection attacks. The CVE record and source item provide details on the SQL injection vulnerability in erzhongxmu Jeewms up to 3.7. The vulnerability can be exploited remotely.

Defensive priority

Apply patch 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 to fix the SQL injection vulnerability in erzhongxmu Jeewms up to 3.7.

Recommended defensive actions

  • Apply patch 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 to fix the SQL injection vulnerability
  • Restrict access to the Autocomplete Data Handler
  • Monitor for suspicious activity
  • Verify and apply patch 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 to prevent SQL injection
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in erzhongxmu Jeewms up to 3.7. The vulnerability affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108684 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108684

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108684 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108684

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108684.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416392

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416392/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108684

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/959244

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/Lib0gus/JeeWMS/security/advisories/GHSA-mc7c-w398-v7xp

    Supplemental source - broken-link

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erzhongxmu/JeeWMS/pull/4

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erzhongxmu/JeeWMS/commit/6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0

    Supplemental source - patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.