# CVE-2026-108781: erzhongxmu JEEWMS SQL injection in PDA interface

Source: https://junglewise.ai/threats/cve-2026-108781-a-security-flaw-has-been-discovered-in-erzhongxmu-jeewms-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108781 · Severity: medium · CVSS 6.3 · Published 2026-10-12

JEEWMS is a warehouse management system used for inventory and goods movement operations. A SQL injection flaw in the PDA interface's goods movement function allows remote attackers to manipulate database queries by crafting malicious search parameters, potentially leading to unauthorized data access or modification of warehouse records.

Technologies: [Erzhongxmu JeeWMS](https://junglewise.ai/threats/technologies/jeewms). Vendors: [Erzhongxmu](https://junglewise.ai/threats/vendors/erzhongxmu).

## Quick answers

**Is CVE-2026-108781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108781 being exploited in the wild.

**How severe is CVE-2026-108781?** Medium severity, with a CVSS score of 6.3, published 12 October 2026.

**Which products and versions are affected?** Erzhongxmu JeeWMS up to 2026.09.27-W39.

**Is there a fix for CVE-2026-108781?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108781 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108781?** Check whether you run Erzhongxmu JeeWMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in the WmToMoveGoodsController.list() method of the PDA Interface component, triggered via manipulation of the searchstr parameter. The flaw allows unauthenticated remote exploitation through the affected endpoint. An attacker can inject SQL commands to read, modify, or delete warehouse management data.

## Affected products

- erzhongxmu JEEWMS up to 2026.09.27-W39

## Timeline

- 2026-10-12: disclosed
- other: Exploit released publicly

## References

- [https://vuldb.com/cve/CVE-2026-108781](https://vuldb.com/cve/CVE-2026-108781)
- [https://vuldb.com/submit/959640](https://vuldb.com/submit/959640)

## Related threats

- [erzhongxmu JEEWMS SQL injection in autocomplete handler](https://junglewise.ai/threats/cve-2026-108782-a-weakness-has-been-identified-in-erzhongxmu-jeewms-up-to-2026)
- [erzhongxmu JEEWMS SQL injection in WmSttInGoodsController](https://junglewise.ai/threats/cve-2026-108779-a-vulnerability-was-identified-in-erzhongxmu-jeewms-up-to-2026)
- [erzhongxmu JEEWMS SQL injection in inbound quality check](https://junglewise.ai/threats/cve-2026-108778-a-vulnerability-was-determined-in-erzhongxmu-jeewms-up-to-2026)
- [erzhongxmu JEEWMS SQL injection in WvGiController](https://junglewise.ai/threats/cve-2026-108777-a-vulnerability-was-found-in-erzhongxmu-jeewms-up-to-2026-09-27)
- [erzhongxmu JEEWMS SQL injection in search endpoint](https://junglewise.ai/threats/cve-2026-108775-a-vulnerability-has-been-found-in-erzhongxmu-jeewms-up-to-2026)