CVE-2026-108778 erzhongxmu CVE debrief

Who should care

Defenders responsible for JEEWMS installations, especially those using version 2026.09.27-W39 or earlier, should assess exposure and prioritize verification and remediation efforts.

Why it matters

This SQL injection vulnerability in erzhongxmu JEEWMS could lead to unauthorized data access or disruption of database operations. Defenders should verify JEEWMS versions, restrict input, and monitor database activity. The exploit has been publicly disclosed, and although the vendor was notified, no response was received.

• Potential for unauthorized data access
• Possible disruption of database operations
• Need for verification of JEEWMS version and exposure
• Priority for updating or patching vulnerable installations

Technical summary

The vulnerability exists in the WmInQmIController.list function of the Inbound Quality Check Pda Interface in erzhongxmu JEEWMS version 2026.09.27-W39. The issue allows remote attackers to inject SQL code by manipulating the searchstr argument. The CVSS score is 5.3, and the severity is MEDIUM. Defenders should prioritize verifying the presence of this vulnerability in their JEEWMS installations, especially if they are using version 2026.09.27-W39 or earlier, and assess the potential impact of SQL injection attacks. This SQL injection vulnerability in erzhongxmu JEEWMS could lead to unauthorized data access or disruption of database operations.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their JEEWMS installations, especially if they are using version 2026.09.27-W39 or earlier, and assess the potential impact of SQL injection attacks.

Recommended defensive actions

• Verify JEEWMS version and check for updates
• Restrict input to the searchstr argument
• Monitor for suspicious database activity
• Implement additional security measures for the Inbound Quality Check Pda Interface
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in version 2026.09.27-W39 of erzhongxmu JEEWMS, the affected component and function, and the public disclosure of the exploit. However, there is no information on confirmed exploitation or specific impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.