TI-2026-01275 CVE-2026-1588 · GHSA-w3wc-vmh2-g2mg
jishenghua jshERP installByPath install path traversal
Priority MEDIUM 56
A vulnerability was found in jishenghua jshERP up to 3.6.
Vulnerabilities
26 records
TI-2026-01238 CVE-2026-1549 · GHSA-6jq3-hpv3-f5mx
jishenghua jshERP PluginController uploadPluginConfigFile path traversal
Priority MEDIUM 57
A vulnerability was identified in jishenghua jshERP up to 3.6.
TI-2026-01235 CVE-2026-1546 · GHSA-cq4p-g9pm-3c37
jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection
Priority MEDIUM 57
A security vulnerability has been detected in jishenghua jshERP up to 3.6.
TI-2025-41195 CVE-2025-67344 · GHSA-3r5x-6g7r-3p8p
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Priority LOW 20
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
TI-2025-41193 CVE-2025-67341 · GHSA-mc2j-c984-23q4
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.
Priority LOW 20
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.
TI-2025-32417 CVE-2025-51746 · GHSA-6rmw-x686-5x74
An issue was discovered in jishenghua JSH_ERP 2.3.1.
Priority MEDIUM 49
An issue was discovered in jishenghua JSH_ERP 2.3.1.
TI-2025-32416 CVE-2025-51745 · GHSA-wcw4-534x-p2m6
An issue was discovered in jishenghua JSH_ERP 2.3.1.
Priority MEDIUM 49
An issue was discovered in jishenghua JSH_ERP 2.3.1.
TI-2025-32415 CVE-2025-51744 · GHSA-pq77-49vf-gcj4
An issue was discovered in jishenghua JSH_ERP 2.3.1.
Priority MEDIUM 49
An issue was discovered in jishenghua JSH_ERP 2.3.1.
TI-2025-32414 CVE-2025-51743 · GHSA-vq83-4r5v-j6xx
An issue was discovered in jishenghua JSH_ERP 2.3.1.
Priority MEDIUM 49
An issue was discovered in jishenghua JSH_ERP 2.3.1.
TI-2025-32413 CVE-2025-51742 · GHSA-29vj-83g2-rvxp
An issue was discovered in jishenghua JSH_ERP 2.3.1.
Priority MEDIUM 49
An issue was discovered in jishenghua JSH_ERP 2.3.1.
TI-2025-37826 CVE-2025-60800 · GHSA-q7fw-jpjh-xmmm
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit…
Priority HIGH 72
Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.
TI-2025-37827 CVE-2025-60801 · GHSA-3xfh-83xg-cw7w
jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code…
Priority HIGH 77
jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.
TI-2025-35000 CVE-2025-55371 · GHSA-qh2h-qr7m-w7fp
Incorrect access control in the component /controller/PersonController.java of jshERP…
Priority MEDIUM 57
Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method.
TI-2025-34999 CVE-2025-55370 · GHSA-hqg2-5gxq-fjhc
Incorrect access control in the component \controller\ResourceController.java of jshERP…
Priority HIGH 73
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.
TI-2025-34998 CVE-2025-55368 · GHSA-9c44-x77q-mr22
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5…
Priority HIGH 73
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
TI-2025-34997 CVE-2025-55367 · GHSA-5m5m-x2gj-fqpx
Incorrect access control in the component \controller\SupplierController.java of jshERP…
Priority MEDIUM 57
Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
TI-2025-34996 CVE-2025-55366 · GHSA-h6wg-mx84-h3rv
Incorrect access control in the component \controller\UserController.java of jshERP v3.5…
Priority MEDIUM 59
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.
TI-2025-08091 CVE-2025-8840 · GHSA-6v3h-xv8f-hwc6
jshERP Endpoint deleteBatch improper authorization
Priority MEDIUM 57
A vulnerability was determined in jshERP up to 3.5.
TI-2025-08090 CVE-2025-8839 · GHSA-5c6r-8224-rmwh
jshERP Endpoint addUser improper authorization
Priority MEDIUM 57
A vulnerability was found in jshERP up to 3.5.
TI-2025-07270 CVE-2025-7948 · GHSA-g5mp-gqvh-992q
jshERP updatePwd password recovery
Priority MEDIUM 57
A vulnerability classified as problematic was found in jshERP up to 3.5.
TI-2025-07269 CVE-2025-7947 · GHSA-3xxw-cpf8-x9hq
jshERP Account delete improper authorization
Priority MEDIUM 57
A vulnerability classified as critical has been found in jshERP up to 3.5.
TI-2025-06903 CVE-2025-7566 · GHSA-7gc3-qw24-r9gc
jshERP SystemConfigController.java exportExcelByParam path traversal
Priority MEDIUM 56
A vulnerability has been found in jshERP up to 3.5 and classified as critical.
TI-2024-15966 CVE-2024-24003 · GHSA-r2c3-2vcp-2qx5
jshERP v3.3 is vulnerable to SQL Injection.
Priority HIGH 82
jshERP v3.3 is vulnerable to SQL Injection.
TI-2024-15967 CVE-2024-24004 · GHSA-rhq8-qg6g-j259
jshERP v3.3 is vulnerable to SQL Injection.
Priority HIGH 82
jshERP v3.3 is vulnerable to SQL Injection.
TI-2024-15965 CVE-2024-24002 · GHSA-rfgg-652g-cx2q
jshERP v3.3 is vulnerable to SQL Injection.
Priority HIGH 82
jshERP v3.3 is vulnerable to SQL Injection.