Skip to contentJishenghua Jsherp vulnerabilities
- jishenghua jsherpjshERP through 3.6 Missing Authorization via /user/batchSetStatusCVE-2026-1106157.1 High
- jishenghua jsherpjshERP through 3.6 Missing Authorization in Master Data Add and Import EndpointsCVE-2026-1091885.3 Medium
- jishenghua jsherpjshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKeyCVE-2026-1091877.1 High
- jishenghua jsherpjshERP through 3.6 Mass Assignment via PUT /user/updateCVE-2026-1091868.7 High
- jishenghua jsherpjshERP through 3.6 Privilege Escalation via PUT /user/updateUserCVE-2026-1091858.7 High
- jishenghua jsherpjshERP through 3.6 Data Scope Bypass via /account/findAccountInOutListCVE-2026-1091845.3 Medium
- jishenghua jsherpjshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status ParameterCVE-2026-1091835.3 Medium
- jishenghua jsherpjshERP through 3.6 Incorrect Authorization via /supplier/exportExcelCVE-2026-1091825.3 Medium
- jishenghua jsherpjshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/listCVE-2026-1091815.3 Medium
- jishenghua jsherpjshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDsCVE-2026-1091805.3 Medium
- jishenghua jsherpjshERP through 3.6 Missing Authorization via /log/list and /log/infoCVE-2026-1091795.3 Medium
- jishenghua jsherpjshERP through 3.6 Missing Authorization via /log Audit EndpointsCVE-2026-1091785.3 Medium
- jishenghua jsherpjishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorizationCVE-2026-1056215.3 Medium
- jishenghua jsherpjshERP through 3.6 Privilege Escalation via userBusiness CRUDCVE-2026-945018.7 High
- jishenghua jsherpjshERP through 3.6 Unauthorized Access via by-id EndpointsCVE-2026-944978.7 High
- jishenghua jsherpjshERP through 3.6 Privilege Escalation via Role ManagementCVE-2026-944968.7 High
- jishenghua jsherpjshERP through 3.6 Missing Authorization via systemConfigCVE-2026-944957.1 High
- jishenghua jsherpjshERP through 3.6 Tenant Information Disclosure via GET /tenant/infoCVE-2026-944945.3 Medium
- jishenghua jsherpjshERP through 3.6 Missing Authorization via updateBtnStrCVE-2026-944145.3 Medium
- jishenghua jsherpjshERP through 3.6 Password Hash Disclosure via /user/infoCVE-2026-944137.1 High
- jishenghua jsherpjshERP through 3.6 Authorization Bypass via resetPwdCVE-2026-944128.7 High
- jishenghua jsherpjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypeCVE-2026-944118.7 High
- jishenghua jsherpjishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgeryCVE-2026-114695.1 Medium
- jishenghua jsherpjishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversalCVE-2026-114675.3 Medium
- jishenghua jsherpjishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgeryCVE-2026-83205.1 Medium
- jishenghua jsherpjishenghua jshERP installByPath install path traversalCVE-2026-15885.1 Medium
- jishenghua jsherpjishenghua jshERP PluginController uploadPluginConfigFile path traversalCVE-2026-15495.3 Medium
- jishenghua jsherpjishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injectionCVE-2026-15465.3 Medium
- jishenghua jsherpjshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the ...CVE-2025-673444.6 Medium
- jishenghua jsherpjshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability...CVE-2025-673414.6 Medium
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint...CVE-2025-517469.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to...CVE-2025-517459.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to...CVE-2025-517449.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory...CVE-2025-517439.8 Critical
- jishenghua jsherpAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /material...CVE-2025-517429.8 Critical
- jishenghua jsherpIncorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a...CVE-2025-60800Public exploit7.5 High
- jishenghua jsherpjshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution ...CVE-2025-608018.2 High
- jishenghua jsherpIncorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows...CVE-2025-553715.3 Medium
- jishenghua jsherpIncorrect access control in the component \controller\ResourceController.java of jshERP v3.5...CVE-2025-553708.8 High
- jishenghua jsherpIncorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows...CVE-2025-553688.8 High
- jishenghua jsherpIncorrect access control in the component \controller\SupplierController.java of jshERP v3.5...CVE-2025-553675.3 Medium
- jishenghua jsherpIncorrect access control in the component \controller\UserController.java of jshERP v3.5 allows...CVE-2025-553665.3 Medium
- jishenghua jsherpjshERP Endpoint deleteBatch improper authorizationCVE-2025-88405.3 Medium
- jishenghua jsherpjshERP Endpoint addUser improper authorizationCVE-2025-88395.3 Medium
- jishenghua jsherpjshERP updatePwd password recoveryCVE-2025-79485.3 Medium
- jishenghua jsherpjshERP Account delete improper authorizationCVE-2025-79475.3 Medium
- jishenghua jsherpjshERP SystemConfigController.java exportExcelByParam path traversalCVE-2025-75665.1 Medium
- jishenghua jsherpjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com...CVE-2024-240039.8 Critical
- jishenghua jsherpjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com...CVE-2024-240049.8 Critical
- jishenghua jsherpjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com...CVE-2024-240029.8 Critical
- Show olderLoading…