Jishenghua Jsherp
51 CVEs affecting Jishenghua Jsherp. Latest disclosed: 2026-10-14. Critical: 9, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51746 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51745 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51744 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51743 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51742 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to par… |
CVE-2024-24003 | Critical | 9.8 | 2024-02-08 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() functio… |
CVE-2024-24004 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of js… |
CVE-2024-24002 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of js… |
CVE-2024-24001 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() funct… |
CVE-2026-109186 | High | 8.8 | 2026-10-12 | jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields… |
CVE-2026-109185 | High | 8.8 | 2026-10-12 | jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary… |
CVE-2026-94501 | High | 8.8 | 2026-09-21 | jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or dele… |
CVE-2026-94412 | High | 8.8 | 2026-09-21 | jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's… |
CVE-2026-94411 | High | 8.8 | 2026-09-21 | jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbit… |
CVE-2025-55370 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID d… |
CVE-2025-55368 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statu… |
CVE-2026-94497 | High | 8.3 | 2026-09-21 | jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read… |
CVE-2026-94496 | High | 8.3 | 2026-09-21 | jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete ro… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-60800 | High | 7.5 | 2025-10-28 | Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted… |