Jishenghua vulnerabilities

Products

• Jsherp 51

Newest

• jishenghua jsherp jshERP through 3.6 Missing Authorization via /user/batchSetStatus CVE-2026-110615 7.1 HighOctober 14, 2026
• jishenghua jsherp jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints CVE-2026-109188 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey CVE-2026-109187 7.1 HighOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Mass Assignment via PUT /user/update CVE-2026-109186 8.7 HighOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Privilege Escalation via PUT /user/updateUser CVE-2026-109185 8.7 HighOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList CVE-2026-109184 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter CVE-2026-109183 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel CVE-2026-109182 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list CVE-2026-109181 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs CVE-2026-109180 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Missing Authorization via /log/list and /log/info CVE-2026-109179 5.3 MediumOctober 12, 2026
• jishenghua jsherp jshERP through 3.6 Missing Authorization via /log Audit Endpoints CVE-2026-109178 5.3 MediumOctober 12, 2026
• jishenghua jsherp jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization CVE-2026-105621 5.3 MediumOctober 6, 2026
• jishenghua jsherp jshERP through 3.6 Privilege Escalation via userBusiness CRUD CVE-2026-94501 8.7 HighSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Unauthorized Access via by-id Endpoints CVE-2026-94497 8.7 HighSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Privilege Escalation via Role Management CVE-2026-94496 8.7 HighSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Missing Authorization via systemConfig CVE-2026-94495 7.1 HighSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info CVE-2026-94494 5.3 MediumSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Missing Authorization via updateBtnStr CVE-2026-94414 5.3 MediumSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Password Hash Disclosure via /user/info CVE-2026-94413 7.1 HighSeptember 21, 2026
• jishenghua jsherp jshERP through 3.6 Authorization Bypass via resetPwd CVE-2026-94412 8.7 HighSeptember 21, 2026
• jishenghua jsherp jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType CVE-2026-94411 8.7 HighSeptember 21, 2026
• jishenghua jsherp jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery CVE-2026-11469 5.1 MediumJune 7, 2026
• jishenghua jsherp jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal CVE-2026-11467 5.3 MediumJune 7, 2026
• jishenghua jsherp jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery CVE-2026-8320 5.1 MediumMay 11, 2026
• jishenghua jsherp jishenghua jshERP installByPath install path traversal CVE-2026-1588 5.1 MediumJanuary 29, 2026
• jishenghua jsherp jishenghua jshERP PluginController uploadPluginConfigFile path traversal CVE-2026-1549 5.3 MediumJanuary 28, 2026
• jishenghua jsherp jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection CVE-2026-1546 5.3 MediumJanuary 28, 2026
• jishenghua jsherp jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the ... CVE-2025-67344 4.6 MediumDecember 12, 2025
• jishenghua jsherp jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability... CVE-2025-67341 4.6 MediumDecember 12, 2025
• jishenghua jsherp An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint... CVE-2025-51746 9.8 CriticalNovember 25, 2025
• jishenghua jsherp An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to... CVE-2025-51745 9.8 CriticalNovember 25, 2025
• jishenghua jsherp An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to... CVE-2025-51744 9.8 CriticalNovember 25, 2025
• jishenghua jsherp An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory... CVE-2025-51743 9.8 CriticalNovember 25, 2025
• jishenghua jsherp An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material... CVE-2025-51742 9.8 CriticalNovember 25, 2025
• jishenghua jsherp Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a... CVE-2025-60800 Public exploit 7.5 HighOctober 28, 2025
• jishenghua jsherp jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution ... CVE-2025-60801 8.2 HighOctober 24, 2025
• jishenghua jsherp Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows... CVE-2025-55371 5.3 MediumAugust 21, 2025
• jishenghua jsherp Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5... CVE-2025-55370 8.8 HighAugust 21, 2025
• jishenghua jsherp Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows... CVE-2025-55368 8.8 HighAugust 21, 2025
• jishenghua jsherp Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5... CVE-2025-55367 5.3 MediumAugust 21, 2025
• jishenghua jsherp Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows... CVE-2025-55366 5.3 MediumAugust 21, 2025
• jishenghua jsherp jshERP Endpoint deleteBatch improper authorization CVE-2025-8840 5.3 MediumAugust 11, 2025
• jishenghua jsherp jshERP Endpoint addUser improper authorization CVE-2025-8839 5.3 MediumAugust 11, 2025
• jishenghua jsherp jshERP updatePwd password recovery CVE-2025-7948 5.3 MediumJuly 22, 2025
• jishenghua jsherp jshERP Account delete improper authorization CVE-2025-7947 5.3 MediumJuly 22, 2025
• jishenghua jsherp jshERP SystemConfigController.java exportExcelByParam path traversal CVE-2025-7566 5.1 MediumJuly 14, 2025
• jishenghua jsherp jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com... CVE-2024-24003 9.8 CriticalFebruary 8, 2024
• jishenghua jsherp jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com... CVE-2024-24004 9.8 CriticalFebruary 6, 2024
• jishenghua jsherp jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com... CVE-2024-24002 9.8 CriticalFebruary 6, 2024
• Show olderLoading…