# jishenghua jshERP.

Every CVE that names jishenghua jshERP among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [jshERP through 3.6 Missing Authorization via /user/batchSetStatus](https://agentprime.io/advisories/CVE-2026-110615.md)
  `CVE-2026-110615` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints](https://agentprime.io/advisories/CVE-2026-109188.md)
  `CVE-2026-109188` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey](https://agentprime.io/advisories/CVE-2026-109187.md)
  `CVE-2026-109187` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Mass Assignment via PUT /user/update](https://agentprime.io/advisories/CVE-2026-109186.md)
  `CVE-2026-109186` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Privilege Escalation via PUT /user/updateUser](https://agentprime.io/advisories/CVE-2026-109185.md)
  `CVE-2026-109185` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList](https://agentprime.io/advisories/CVE-2026-109184.md)
  `CVE-2026-109184` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter](https://agentprime.io/advisories/CVE-2026-109183.md)
  `CVE-2026-109183` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel](https://agentprime.io/advisories/CVE-2026-109182.md)
  `CVE-2026-109182` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list](https://agentprime.io/advisories/CVE-2026-109181.md)
  `CVE-2026-109181` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs](https://agentprime.io/advisories/CVE-2026-109180.md)
  `CVE-2026-109180` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via /log/list and /log/info](https://agentprime.io/advisories/CVE-2026-109179.md)
  `CVE-2026-109179` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via /log Audit Endpoints](https://agentprime.io/advisories/CVE-2026-109178.md)
  `CVE-2026-109178` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization](https://agentprime.io/advisories/CVE-2026-105621.md)
  `CVE-2026-105621` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [jshERP through 3.6 Privilege Escalation via userBusiness CRUD](https://agentprime.io/advisories/CVE-2026-94501.md)
  `CVE-2026-94501` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP through 3.6 Unauthorized Access via by-id Endpoints](https://agentprime.io/advisories/CVE-2026-94497.md)
  `CVE-2026-94497` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP through 3.6 Privilege Escalation via Role Management](https://agentprime.io/advisories/CVE-2026-94496.md)
  `CVE-2026-94496` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via systemConfig](https://agentprime.io/advisories/CVE-2026-94495.md)
  `CVE-2026-94495` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info](https://agentprime.io/advisories/CVE-2026-94494.md)
  `CVE-2026-94494` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via updateBtnStr](https://agentprime.io/advisories/CVE-2026-94414.md)
  `CVE-2026-94414` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP through 3.6 Password Hash Disclosure via /user/info](https://agentprime.io/advisories/CVE-2026-94413.md)
  `CVE-2026-94413` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure
- [jshERP through 3.6 Authorization Bypass via resetPwd](https://agentprime.io/advisories/CVE-2026-94412.md)
  `CVE-2026-94412` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType](https://agentprime.io/advisories/CVE-2026-94411.md)
  `CVE-2026-94411` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery](https://agentprime.io/advisories/CVE-2026-11469.md)
  `CVE-2026-11469` · CVE record: jishenghua jshERP · CVSS 5.1 Medium · Not analysed yet · Published 7 Jun 2026 · Tags: Server-side request forgery (SSRF)
- [jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal](https://agentprime.io/advisories/CVE-2026-11467.md)
  `CVE-2026-11467` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 7 Jun 2026 · Tags: Path traversal
- [jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery](https://agentprime.io/advisories/CVE-2026-8320.md)
  `CVE-2026-8320` · CVE record: jishenghua jshERP · CVSS 5.1 Medium · Not analysed yet · Published 11 May 2026 · Tags: Server-side request forgery (SSRF)
- [jishenghua jshERP installByPath install path traversal](https://agentprime.io/advisories/CVE-2026-1588.md)
  `CVE-2026-1588` · CVE record: jishenghua jshERP · CVSS 5.1 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: Path traversal
- [jishenghua jshERP PluginController uploadPluginConfigFile path traversal](https://agentprime.io/advisories/CVE-2026-1549.md)
  `CVE-2026-1549` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Path traversal
- [jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection](https://agentprime.io/advisories/CVE-2026-1546.md)
  `CVE-2026-1546` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Other injection, SQL injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=jishenghua-jsherp>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/jishenghua-jsherp/>. Everything for agents: <https://agentprime.io/llms.txt>.