jishenghua vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-110615 jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to chaHigh 7.1 · Oct 14, 2026
• CVE-2026-109187 jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInHigh 7.1 · Oct 12, 2026
• CVE-2026-109186 jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields iHigh 8.7 · Oct 12, 2026
• CVE-2026-109185 jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary rHigh 8.7 · Oct 12, 2026
• CVE-2026-94501 jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or deletHigh 8.7 · Sep 21, 2026
• CVE-2026-94497 jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types.High 8.7 · Sep 21, 2026
• CVE-2026-94496 jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete rolHigh 8.7 · Sep 21, 2026
• CVE-2026-94495 jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system coHigh 7.1 · Sep 21, 2026
• CVE-2026-94413 jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any usHigh 7.1 · Sep 21, 2026
• CVE-2026-94412 jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's High 8.7 · Sep 21, 2026
• CVE-2026-94411 jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrHigh 8.7 · Sep 21, 2026
• CVE-2025-51746 An issue was discovered in jishenghua JSH_ERP 2.3.1.Critical 9.8 · Nov 25, 2025
• CVE-2025-51745 An issue was discovered in jishenghua JSH_ERP 2.3.1.Critical 9.8 · Nov 25, 2025
• CVE-2025-51744 An issue was discovered in jishenghua JSH_ERP 2.3.1.Critical 9.8 · Nov 25, 2025
• CVE-2025-51743 An issue was discovered in jishenghua JSH_ERP 2.3.1.Critical 9.8 · Nov 25, 2025
• CVE-2025-51742 An issue was discovered in jishenghua JSH_ERP 2.3.1.Critical 9.8 · Nov 25, 2025
• CVE-2025-60800 Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GHigh 7.5 · Oct 28, 2025
• CVE-2025-60801 jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.High 8.2 · Oct 24, 2025
• CVE-2025-55370 Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID daHigh 8.8 · Aug 21, 2025
• CVE-2025-55368 Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statusHigh 8.8 · Aug 21, 2025
• CVE-2024-24003 jshERP v3.3 is vulnerable to SQL Injection.Critical 9.8 · Feb 7, 2024
• CVE-2024-24004 jshERP v3.3 is vulnerable to SQL Injection.Critical 9.8 · Feb 6, 2024
• CVE-2024-24002 jshERP v3.3 is vulnerable to SQL Injection.Critical 9.8 · Feb 6, 2024
• CVE-2024-24001 jshERP v3.3 is vulnerable to SQL Injection.Critical 9.8 · Feb 6, 2024