CVE-2025-5386 is a Medium severity flaw (CVSS 6.3) in JeeWMS, an open source warehouse management system, in the function transEditor of /cgformTransController.do?transEditor. The weakness is SQL injection. The product has no version numbers, so the record cannot name a fixed release. Treat it as unpatched.
What's affected
The record says JeeWMS is affected "up to 20250504", a date and not a release number. The product uses rolling releases and does not use versioning, so the record states that details of affected and updated releases are not available.
The affected function is transEditor, reached through /cgformTransController.do?transEditor. The record rates the attack as remote.
Several JeeWMS records published on the same day, within CVE-2025-5384 to CVE-2025-5390, cite the same project issue, so one deployment can carry more than one of these weaknesses.
How to check if you're exposed
Work out which snapshot of JeeWMS you run. Because there are no release numbers, compare your code to the date in the record:
git log -1 --format=%cd
grep -rn "cgformTransController" src/ | head
If your build is dated 4 May 2025 or earlier, assume it is affected. Then look in the web server logs for requests to the path in the record from addresses you do not expect, and check whether the path is reachable from outside your network.
What to do now
- Restrict the JeeWMS web interface to trusted networks, using a VPN or an IP allow list, until you have a fix you can verify.
- Block or require authentication for the path /cgformTransController.do?transEditor at the reverse proxy, if your workflow does not depend on it.
- Review the project issue linked in the record and compare your code with any later commits the maintainers publish.
- Run the application database account with minimum privileges, and keep backups you have tested.
- Record the exposure in your risk register, and plan a migration if the maintainers do not publish a fix.
Why it matters
The weakness is CWE-89, SQL injection, within the CWE-74 injection class. User input reaches a database query without being separated from the query text, which can let a visitor change what the database runs.
The fix is to bind parameters instead of building strings. For a rolling release with no versions, the practical test is whether your own checkout contains that change, which is why the commit date matters more than any label.
Quick check
Which JeeWMS version fixes this?
None is named. JeeWMS uses rolling releases without version numbers, so check your code against the project issue and any later commits, and treat older builds as affected.
Is this on the CISA Known Exploited list?
No. The record is not flagged in the CISA catalogue. Limit exposure anyway, because the weakness is remotely reachable per the record.
Sources
Last reviewed: 18 October 2026.
