Jishenghua vulnerabilities
28 CVEs and advisories name Jishenghua as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-110615jshERP through 3.6 Missing Authorization via /user/batchSetStatus
- CVE-2026-109188jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
- CVE-2026-109187jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
- CVE-2026-109186jshERP through 3.6 Mass Assignment via PUT /user/update
- CVE-2026-109185jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
- CVE-2026-109184jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
- CVE-2026-109183jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
- CVE-2026-109182jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
- CVE-2026-109181jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
- CVE-2026-109180jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
- CVE-2026-109179jshERP through 3.6 Missing Authorization via /log/list and /log/info
- CVE-2026-109178jshERP through 3.6 Missing Authorization via /log Audit Endpoints
- CVE-2026-105621jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
- CVE-2026-94501jshERP through 3.6 Privilege Escalation via userBusiness CRUD
- CVE-2026-94497jshERP through 3.6 Unauthorized Access via by-id Endpoints
- CVE-2026-94496jshERP through 3.6 Privilege Escalation via Role Management
- CVE-2026-94495jshERP through 3.6 Missing Authorization via systemConfig
- CVE-2026-94494jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
- CVE-2026-94414jshERP through 3.6 Missing Authorization via updateBtnStr
- CVE-2026-94413jshERP through 3.6 Password Hash Disclosure via /user/info
- CVE-2026-94412jshERP through 3.6 Authorization Bypass via resetPwd
- CVE-2026-94411jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
- CVE-2026-11469jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery
- CVE-2026-11467jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
- CVE-2026-8320jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery
- CVE-2026-1588jishenghua jshERP installByPath install path traversal
- CVE-2026-1549jishenghua jshERP PluginController uploadPluginConfigFile path traversal
- CVE-2026-1546jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection