# cve.now: Jishenghua

The newest entries naming Jishenghua as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110615](https://cve.now/CVE-2026-110615.md): jshERP through 3.6 Missing Authorization via /user/batchSetStatus (CVSS 7.1)
- [CVE-2026-109188](https://cve.now/CVE-2026-109188.md): jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints (CVSS 5.3)
- [CVE-2026-109187](https://cve.now/CVE-2026-109187.md): jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey (CVSS 7.1)
- [CVE-2026-109186](https://cve.now/CVE-2026-109186.md): jshERP through 3.6 Mass Assignment via PUT /user/update (CVSS 8.7)
- [CVE-2026-109185](https://cve.now/CVE-2026-109185.md): jshERP through 3.6 Privilege Escalation via PUT /user/updateUser (CVSS 8.7)
- [CVE-2026-109184](https://cve.now/CVE-2026-109184.md): jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList (CVSS 5.3)
- [CVE-2026-109183](https://cve.now/CVE-2026-109183.md): jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter (CVSS 5.3)
- [CVE-2026-109182](https://cve.now/CVE-2026-109182.md): jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel (CVSS 5.3)
- [CVE-2026-109181](https://cve.now/CVE-2026-109181.md): jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list (CVSS 5.3)
- [CVE-2026-109180](https://cve.now/CVE-2026-109180.md): jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs (CVSS 5.3)
- [CVE-2026-109179](https://cve.now/CVE-2026-109179.md): jshERP through 3.6 Missing Authorization via /log/list and /log/info (CVSS 5.3)
- [CVE-2026-109178](https://cve.now/CVE-2026-109178.md): jshERP through 3.6 Missing Authorization via /log Audit Endpoints (CVSS 5.3)
- [CVE-2026-105621](https://cve.now/CVE-2026-105621.md): jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization (CVSS 5.3)
- [CVE-2026-94501](https://cve.now/CVE-2026-94501.md): jshERP through 3.6 Privilege Escalation via userBusiness CRUD (CVSS 8.8)
- [CVE-2026-94497](https://cve.now/CVE-2026-94497.md): jshERP through 3.6 Unauthorized Access via by-id Endpoints (CVSS 8.3)
- [CVE-2026-94496](https://cve.now/CVE-2026-94496.md): jshERP through 3.6 Privilege Escalation via Role Management (CVSS 8.3)
- [CVE-2026-94495](https://cve.now/CVE-2026-94495.md): jshERP through 3.6 Missing Authorization via systemConfig (CVSS 7.1)
- [CVE-2026-94494](https://cve.now/CVE-2026-94494.md): jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info (CVSS 5.0)
- [CVE-2026-94414](https://cve.now/CVE-2026-94414.md): jshERP through 3.6 Missing Authorization via updateBtnStr (CVSS 5.4)
- [CVE-2026-94413](https://cve.now/CVE-2026-94413.md): jshERP through 3.6 Password Hash Disclosure via /user/info (CVSS 6.5)
- [CVE-2026-94412](https://cve.now/CVE-2026-94412.md): jshERP through 3.6 Authorization Bypass via resetPwd (CVSS 8.8)
- [CVE-2026-94411](https://cve.now/CVE-2026-94411.md): jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType (CVSS 8.8)
- [CVE-2026-11469](https://cve.now/CVE-2026-11469.md): jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery (CVSS 5.1)
- [CVE-2026-11467](https://cve.now/CVE-2026-11467.md): jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal (CVSS 5.3)
- [CVE-2026-8320](https://cve.now/CVE-2026-8320.md): jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery (CVSS 5.1)
- [CVE-2026-1588](https://cve.now/CVE-2026-1588.md): jishenghua jshERP installByPath install path traversal (CVSS 5.1)
- [CVE-2026-1549](https://cve.now/CVE-2026-1549.md): jishenghua jshERP PluginController uploadPluginConfigFile path traversal (CVSS 5.3)
- [CVE-2026-1546](https://cve.now/CVE-2026-1546.md): jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jishenghua
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.