CVE-2026-108777 erzhongxmu CVE debrief

Who should care

Defenders responsible for JEEWMS installations, especially those using version 2026.09.27-W39 or earlier, should assess the potential impact of this vulnerability and prioritize verification and potential remediation.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their JEEWMS installations, especially if the version 2026.09.27-W39 or earlier is in use, and assess the potential impact of SQL injection attacks.

• Potential SQL injection attacks
• Remote exploitation of the vulnerability
• Need for verification of vulnerability presence and impact
• Potential data breaches or system compromise

Technical summary

The vulnerability affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java in erzhongxmu JEEWMS up to 2026.09.27-W39. The manipulation of the argument searchstr results in SQL injection, which can be executed remotely. The vulnerability has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Defenders should prioritize verifying the presence of this vulnerability in their JEEWMS installations, especially if the version 2026.09.27-W39 or earlier is in use, and assess the potential impact of SQL injection attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their JEEWMS installations, especially if the version 2026.09.27-W39 or earlier is in use, and assess the potential impact of SQL injection attacks.

Recommended defensive actions

• Verify the presence of this vulnerability in JEEWMS installations, especially if the version 2026.09.27-W39 or earlier is in use.
• Assess the potential impact of SQL injection attacks on the system.
• Consider applying patches or updates to fix the vulnerability, if available.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details about the vulnerability in erzhongxmu JEEWMS. However, the evidence is limited, and further verification is required to determine the full scope of the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.