CVE-2026-3027: falha de média gravidade em erzhongxmu JEEWMS
erzhongxmu JEEWMS UEditor getContent.jsp cross site scripting
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
probabilidade de exploração
0.5%top 61% das CVEs
exploração observada
nãonenhuma fonte reporta
A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
erzhongxmu · JEEWMSCVEs relacionadas — erzhongxmu JEEWMS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-3026MEDIUMerzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgeryEPSS 0.5%CVE-2026-3028MEDIUMerzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scriptingEPSS 0.5%CVE-2026-108775MEDIUMerzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injectionEPSS 0.3%CVE-2026-108774MEDIUMerzhongxmu JEEWMS MdBinController.java getbinallagv sql injectionEPSS 0.3%CVE-2026-108781MEDIUMerzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injectionEPSS 0.2%CVE-2026-108782MEDIUMerzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injectionEPSS 0.2%