{"id":"CVE-2026-108684","title":"A vulnerability was detected in erzhongxmu Jeewms up to 3.7","summary":"A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a …","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-74","CWE-89"],"vendor":"erzhongxmu","product":"Jeewms","affected":["Jeewms 3.0","Jeewms 3.1","Jeewms 3.2","Jeewms 3.3","Jeewms 3.4","Jeewms 3.5","Jeewms 3.6","Jeewms 3.7"],"published":"2026-10-11","updated":"2026-10-15","sourceUpdated":"2026-10-15T16:17:36.730","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108684","references":[{"url":"https://github.com/Lib0gus/JeeWMS/security/advisories/GHSA-mc7c-w398-v7xp","label":"cna@vuldb.com"},{"url":"https://github.com/erzhongxmu/JeeWMS/","label":"cna@vuldb.com"},{"url":"https://github.com/erzhongxmu/JeeWMS/commit/6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0","label":"cna@vuldb.com"},{"url":"https://github.com/erzhongxmu/JeeWMS/pull/4","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-108684","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/959244","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/416392","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/416392/cti","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00256,"epssPercentile":0.17075,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T14:50:42.846861Z"},"ingestedAt":"2026-10-12T14:50:34.054Z","slug":"CVE-2026-108684","body":"## Overview\n\nA vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":222464,"id":"CVE-2026-108684","ts":1792081031889,"field":"exploit_available","old":"false","new":"true"}]}