A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection.
The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 8
https://github.com/Lib0gus/JeeWMS/security/advisories/GHSA-mc7c-w398-v7xp
cna@vuldb.com
https://github.com/erzhongxmu/JeeWMS/
cna@vuldb.com
https://github.com/erzhongxmu/JeeWMS/commit/6e29bd57972a499e9c8a81a2dbe94d0d5cf…
cna@vuldb.com
https://github.com/erzhongxmu/JeeWMS/pull/4
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-108684
cna@vuldb.com
https://vuldb.com/submit/959244
cna@vuldb.com
https://vuldb.com/vuln/416392
cna@vuldb.com
https://vuldb.com/vuln/416392/cti
cna@vuldb.com