CVE-2026-94501 | High | 8.8 | 2026-09-21 | jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or dele… |
CVE-2026-94497 | High | 8.3 | 2026-09-21 | jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read… |
CVE-2026-94496 | High | 8.3 | 2026-09-21 | jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete ro… |
CVE-2026-94495 | High | 7.1 | 2026-09-21 | jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system c… |
CVE-2026-94494 | Medium | 5.0 | 2026-09-21 | jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info end… |
CVE-2026-94414 | Medium | 5.4 | 2026-09-21 | jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-perm… |
CVE-2026-94413 | Medium | 6.5 | 2026-09-21 | jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any u… |
CVE-2026-94412 | High | 8.8 | 2026-09-21 | jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's… |
CVE-2026-94411 | High | 8.8 | 2026-09-21 | jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbit… |
CVE-2026-11469 | Medium | 4.7 | 2026-06-08 | A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/P… |
CVE-2026-11467 | Medium | 5.4 | 2026-06-08 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-b… |
CVE-2026-8320 | Medium | 4.7 | 2026-05-11 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/… |
CVE-2026-1588 | Low | 2.7 | 2026-01-29 | A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the com… |
CVE-2026-1549 | Medium | 4.3 | 2026-01-28 | A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploa… |
CVE-2026-1546 | Medium | 6.3 | 2026-01-28 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/dep… |
CVE-2025-67344 | Medium | 4.6 | 2025-12-12 | jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. |
CVE-2025-67341 | Medium | 4.6 | 2025-12-12 | jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Ad… |
CVE-2025-51746 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51745 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51744 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51743 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51742 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to par… |
CVE-2025-60800 | High | 7.5 | 2025-10-28 | Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-55371 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the h… |
CVE-2025-55370 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID d… |
CVE-2025-55368 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statu… |
CVE-2025-55367 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier s… |
CVE-2025-55366 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execu… |
CVE-2025-8840 | Medium | 5.4 | 2025-08-11 | A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The ma… |
CVE-2025-8839 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The… |
CVE-2025-7948 | Medium | 4.3 | 2025-07-22 | A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/us… |
CVE-2025-7947 | Medium | 5.4 | 2025-07-22 | A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Ha… |
CVE-2025-7566 | Medium | 4.7 | 2025-07-14 | A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main… |
CVE-2024-24003 | Critical | 9.8 | 2024-02-08 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() functio… |
CVE-2024-24004 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of js… |
CVE-2024-24002 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of js… |
CVE-2024-24001 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() funct… |