Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
53 results · page 1 of 2
Oct 14, 2026jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to chaCVE-2026-110615 · Other software · jishenghua · reported by VulnCheckHigh 7.1
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and imCVE-2026-109188 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInCVE-2026-109187 · Other software · jishenghua · reported by VulnCheckHigh 7.1
jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields iCVE-2026-109186 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary rCVE-2026-109185 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplCVE-2026-109184 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHCVE-2026-109183 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restCVE-2026-109182 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users'CVE-2026-109181 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId oCVE-2026-109180 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log.CVE-2026-109179 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entrCVE-2026-109178 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A security flaw has been discovered in jishenghua jshERP up to 3.5.CVE-2026-105621 · Other software · jishenghua · reported by VulDBLow 2.1
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or deletCVE-2026-94501 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types.CVE-2026-94497 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete rolCVE-2026-94496 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system coCVE-2026-94495 · Other software · jishenghua · reported by VulnCheckHigh 7.1
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpCVE-2026-94494 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permiCVE-2026-94414 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any usCVE-2026-94413 · Other software · jishenghua · reported by VulnCheckHigh 7.1
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's CVE-2026-94412 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrCVE-2026-94411 · Other software · jishenghua · reported by VulnCheckHigh 8.7
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2026A flaw has been found in jishenghua jshERP up to 3.6.CVE-2026-11469 · Other software · jishenghua · reported by VulDBLow 2
A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2026A security vulnerability has been detected in jishenghua jshERP up to 3.6.CVE-2026-11467 · Other software · jishenghua · reported by VulDBLow 2.1
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026A security vulnerability has been detected in jishenghua jshERP up to 3.6.CVE-2026-8320 · Other software · jishenghua · reported by VulDBLow 2
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A vulnerability was found in jishenghua jshERP up to 3.6.CVE-2026-1588 · Other software · jishenghua · reported by VulDBLow 2
A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026A vulnerability was identified in jishenghua jshERP up to 3.6.CVE-2026-1549 · Other software · jishenghua · reported by VulDBLow 2.1
A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026A security vulnerability has been detected in jishenghua jshERP up to 3.6.CVE-2026-1546 · Other software · jishenghua · reported by VulDBLow 2.1
A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.CVE-2025-67344 · Other software · Jishenghua · reported by MITREMedium 4.6
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.CVE-2025-67341 · Other software · Jishenghua · reported by MITREMedium 4.6
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025An issue was discovered in jishenghua JSH_ERP 2.3.1.CVE-2025-51746 · Other software · Jishenghua · reported by MITRECritical 9.8
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackpax.topgist.github.com
Nov 25, 2025An issue was discovered in jishenghua JSH_ERP 2.3.1.CVE-2025-51745 · Other software · Jishenghua · reported by MITRECritical 9.8
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackpax.topgist.github.com
Nov 25, 2025An issue was discovered in jishenghua JSH_ERP 2.3.1.CVE-2025-51744 · Other software · Jishenghua · reported by MITRECritical 9.8
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackpax.topgist.github.com
Nov 25, 2025An issue was discovered in jishenghua JSH_ERP 2.3.1.CVE-2025-51743 · Other software · Jishenghua · reported by MITRECritical 9.8
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackpax.topgist.github.com
Nov 25, 2025An issue was discovered in jishenghua JSH_ERP 2.3.1.CVE-2025-51742 · Other software · Jishenghua · reported by MITRECritical 9.8
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackpax.topgist.github.com
Oct 28, 2025Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GCVE-2025-60800 · Other software · Jishenghua · reported by MITREHigh 7.5
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.CVE-2025-60801 · Other software · Jishenghua · reported by MITREHigh 8.2
jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfushuling.comgithub.com
Aug 21, 2025Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the haCVE-2025-55371 · Other software · Jishenghua · reported by MITREMedium 5.3
Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID daCVE-2025-55370 · Other software · Jishenghua · reported by MITREHigh 8.8
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier statusCVE-2025-55368 · Other software · Jishenghua · reported by MITREHigh 8.8
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier stCVE-2025-55367 · Other software · Jishenghua · reported by MITREMedium 5.3
Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and executCVE-2025-55366 · Other software · Jishenghua · reported by MITREMedium 5.3
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025A vulnerability was determined in jshERP up to 3.5.CVE-2025-8840 · Other software · Jishenghua · reported by VulDBLow 2.1
A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025A vulnerability was found in jshERP up to 3.5.CVE-2025-8839 · Other software · Jishenghua · reported by VulDBLow 2.1
A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A vulnerability classified as problematic was found in jshERP up to 3.5.CVE-2025-7948 · Other software · Jishenghua · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A vulnerability classified as critical has been found in jshERP up to 3.5.CVE-2025-7947 · Other software · Jishenghua · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in jshERP up to 3.5 and classified as critical.CVE-2025-7566 · Other software · Jishenghua · reported by VulDBLow 2
A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main/java/com/jsh/erp/controller/SystemConfigController.java. The manipulation of the argument Title leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024jshERP v3.3 is vulnerable to SQL Injection.CVE-2024-24003 · Other software · Jishenghua · reported by MITRECritical 9.8
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024jshERP v3.3 is vulnerable to SQL Injection.CVE-2024-24004 · Other software · jishenghua · reported by MITRECritical 9.8
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
- Product
- jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2024jshERP v3.3 is vulnerable to SQL Injection.CVE-2024-24002 · Other software · jishenghua · reported by MITRECritical 9.8
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
- Product
- jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.