---
id: CVE-2026-108774
title: A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39
summary: >-
  A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected
  element is the function getbinall/getbinallagv of the file
  src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a
  manipulation of the argument…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-74
  - CWE-89
published: '2026-10-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:18:21.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108774'
references:
  - url: 'https://vuldb.com/cve/CVE-2026-108774'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/959595'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416555'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416555/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
epss: 0.00192
epssPercentile: 0.08823
ingestedAt: '2026-10-12T14:50:34.071Z'
vendor: erzhongxmu
product: JEEWMS
affected:
  - JEEWMS 2026.09.27-W39
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T17:02:37.242117Z'
---

## Overview

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.