Jjishenghua

Products

Exploited and recent CVEs

• CVE-2026-110615 High 7.1 jshERP through 3.6 Missing Authorization via /user/batchSetStatus 0.4%
• CVE-2026-109188 Medium 4.3 jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints 0.3%
• CVE-2026-109187 Medium 6.5 jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey 0.2%
• CVE-2026-109186 High 8.8 jshERP through 3.6 Mass Assignment via PUT /user/update 0.4%
• CVE-2026-109185 High 8.8 jshERP through 3.6 Privilege Escalation via PUT /user/updateUser 0.3%
• CVE-2026-109184 Medium 4.3 jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList 0.2%
• CVE-2026-109183 Medium 4.3 jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter 0.2%
• CVE-2026-109182 Medium 4.3 jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel 0.2%
• CVE-2026-109181 Medium 4.3 jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list 0.2%
• CVE-2026-109180 Medium 4.3 jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs 0.2%
• CVE-2026-109179 Medium 4.3 jshERP through 3.6 Missing Authorization via /log/list and /log/info 0.2%
• CVE-2026-109178 Medium 5.4 jshERP through 3.6 Missing Authorization via /log Audit Endpoints 0.2%
• CVE-2026-105621 Medium 5.4 jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization 0.2%
• CVE-2026-94501 High 8.8 jshERP through 3.6 Privilege Escalation via userBusiness CRUD 0.5%
• CVE-2026-94497 High 8.3 jshERP through 3.6 Unauthorized Access via by-id Endpoints 0.5%
• CVE-2026-94496 High 8.3 jshERP through 3.6 Privilege Escalation via Role Management 0.5%
• CVE-2026-94495 High 7.1 jshERP through 3.6 Missing Authorization via systemConfig 0.4%
• CVE-2026-94494 Medium 5.0 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info 0.4%
• CVE-2026-94414 Medium 5.4 jshERP through 3.6 Missing Authorization via updateBtnStr 0.4%
• CVE-2026-94413 Medium 6.5 jshERP through 3.6 Password Hash Disclosure via /user/info 0.5%
• CVE-2026-94412 High 8.8 jshERP through 3.6 Authorization Bypass via resetPwd 0.5%
• CVE-2026-94411 High 8.8 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType 0.5%
• CVE-2026-11469 Medium 4.7 jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery 0.2%
• CVE-2026-11467 Medium 5.4 jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal 0.3%
• CVE-2026-8320 Medium 4.7 jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery 0.2%
• CVE-2026-1588 Low 2.7 jishenghua jshERP installByPath install path traversal 0.7%
• CVE-2026-1549 Medium 4.3 jishenghua jshERP PluginController uploadPluginConfigFile path traversal 0.5%
• CVE-2026-1546 Medium 6.3 jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection 0.4%