CVE-2026-108684 Details
Description
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.
A SQL injection vulnerability has been identified in erzhongxmu JeeWMS versions prior to 3.7. The issue arises in the Autocomplete Data Handler component, specifically within the getTreeData function of the JeecgFormDemoController.java file. The vulnerability can be exploited remotely by manipulating the searchVal parameter, allowing for unauthorized SQL commands to be executed.
Users are advised to update to the latest version of JeeWMS where this vulnerability has been fixed. The specific commit addressing this issue is 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/erzhongxmu/JeeWMS/ | [email protected] | Vendor |
| https://github.com/erzhongxmu/JeeWMS/commit/6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 | [email protected] | Source CodeVendor |
| https://github.com/erzhongxmu/JeeWMS/pull/4 | [email protected] | Issue TrackingVendor |
| https://github.com/Lib0gus/JeeWMS/security/advisories/GHSA-mc7c-w398-v7xp | [email protected] | AdvisoryBroken Link |
| https://vuldb.com/cve/CVE-2026-108684 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/959244 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416392 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416392/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| erzhongxmu Jeewms | <= 3.7 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |