CVE-2026-3027 - Vulnerability Analysis

Overview

erzhongxmu JEEWMS <= 3.7 contains a stored XSS caused by manipulation of the "myEditor" argument in src/main/webapp/plug-in/ueditor/jsp/getContent.jsp, letting remote attackers execute scripts, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking or data theft.

Mitigation

Update to the latest version of erzhongxmu JEEWMS.

References

• https://vuldb.com/?ctiid.347383
• https://vuldb.com/?id.347383
• https://vuldb.com/?submit.756523
• https://www.notion.so/JEEWMS-Reflected-XSS-Vulnerability-in-UEditor-Module-304ea92a3c41806a97ffc9b707f2fbf0

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner