What’s Vulnerable › Products

jishenghua jshERP vulnerabilities

51 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 47 published in the last 12 months.

Check whether your jishenghua jshERP version is affected

Latest jishenghua jshERP vulnerabilities

• CVE-2026-110615 — jshERP through 3.6 Missing Authorization via /user/batchSetStatus (CVSS 7.1)
• CVE-2026-109188 — jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints (CVSS 4.3)
• CVE-2026-109187 — jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey (CVSS 6.5)
• CVE-2026-109186 — jshERP through 3.6 Mass Assignment via PUT /user/update (CVSS 8.8)
• CVE-2026-109185 — jshERP through 3.6 Privilege Escalation via PUT /user/updateUser (CVSS 8.8)
• CVE-2026-109184 — jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList (CVSS 4.3)
• CVE-2026-109183 — jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter (CVSS 4.3)
• CVE-2026-109182 — jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel (CVSS 4.3)
• CVE-2026-109181 — jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list (CVSS 4.3)
• CVE-2026-109180 — jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs (CVSS 4.3)
• CVE-2026-109179 — jshERP through 3.6 Missing Authorization via /log/list and /log/info (CVSS 4.3)
• CVE-2026-109178 — jshERP through 3.6 Missing Authorization via /log Audit Endpoints (CVSS 5.4)
• CVE-2026-105621 — jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization (CVSS 5.4)
• CVE-2026-94501 — jshERP through 3.6 Privilege Escalation via userBusiness CRUD (CVSS 8.8)
• CVE-2026-94497 — jshERP through 3.6 Unauthorized Access via by-id Endpoints (CVSS 8.3)
• CVE-2026-94496 — jshERP through 3.6 Privilege Escalation via Role Management (CVSS 8.3)
• CVE-2026-94495 — jshERP through 3.6 Missing Authorization via systemConfig (CVSS 7.1)
• CVE-2026-94494 — jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info (CVSS 5.0)
• CVE-2026-94414 — jshERP through 3.6 Missing Authorization via updateBtnStr (CVSS 5.4)
• CVE-2026-94413 — jshERP through 3.6 Password Hash Disclosure via /user/info (CVSS 6.5)
• CVE-2026-94412 — jshERP through 3.6 Authorization Bypass via resetPwd (CVSS 8.8)
• CVE-2026-94411 — jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType (CVSS 8.8)
• CVE-2026-11469 — jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery (CVSS 4.7)
• CVE-2026-11467 — jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal (CVSS 5.4)
• CVE-2026-8320 — jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery (CVSS 4.7)