Jishenghua Jsherp
29 CVEs affecting Jishenghua Jsherp. Latest disclosed: 2026-06-08. Critical: 9, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51746 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51745 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51744 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51743 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51742 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to par… |
CVE-2024-24003 | Critical | 9.8 | 2024-02-08 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() functio… |
CVE-2024-24004 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of js… |
CVE-2024-24002 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of js… |
CVE-2024-24001 | Critical | 9.8 | 2024-02-07 | jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() funct… |
CVE-2025-55370 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID d… |
CVE-2025-55368 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statu… |
CVE-2025-60801 | High | 8.2 | 2025-10-24 | jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. |
CVE-2025-60800 | High | 7.5 | 2025-10-28 | Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted… |
CVE-2026-1546 | Medium | 6.3 | 2026-01-28 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/dep… |
CVE-2025-8839 | Medium | 6.3 | 2025-08-11 | A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The… |
CVE-2026-11467 | Medium | 5.4 | 2026-06-08 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-b… |
CVE-2025-8840 | Medium | 5.4 | 2025-08-11 | A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The ma… |
CVE-2025-7947 | Medium | 5.4 | 2025-07-22 | A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Ha… |
CVE-2025-55371 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the h… |
CVE-2025-55367 | Medium | 5.3 | 2025-08-21 | Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier s… |