Advisories · Technology
jishenghua jshERP.
Every CVE that names jishenghua jshERP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
jshERP through 3.6 Missing Authorization via /user/batchSetStatus
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
- jishenghua jshERP
- Broken access control
- CVSS 7.1 High
jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
- jishenghua jshERP
- Broken access control
- CVSS 8.7 High
jshERP through 3.6 Mass Assignment via PUT /user/update
- jishenghua jshERP
- Broken access control
- CVSS 8.7 High
jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Missing Authorization via /log/list and /log/info
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Missing Authorization via /log Audit Endpoints
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
- jishenghua jshERP
- Privilege escalation
- Broken access control
- CVSS 8.7 High
jshERP through 3.6 Privilege Escalation via userBusiness CRUD
- jishenghua jshERP
- Broken access control
- CVSS 8.7 High
jshERP through 3.6 Unauthorized Access via by-id Endpoints
- jishenghua jshERP
- Broken access control
- CVSS 8.7 High
jshERP through 3.6 Privilege Escalation via Role Management
- jishenghua jshERP
- Broken access control
- CVSS 7.1 High
jshERP through 3.6 Missing Authorization via systemConfig
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
- jishenghua jshERP
- Broken access control
- CVSS 5.3 Medium
jshERP through 3.6 Missing Authorization via updateBtnStr
- jishenghua jshERP
- Broken access control
- CVSS 7.1 High
jshERP through 3.6 Password Hash Disclosure via /user/info
- jishenghua jshERP
- Information disclosure
- CVSS 8.7 High
jshERP through 3.6 Authorization Bypass via resetPwd
- jishenghua jshERP
- Broken access control
- CVSS 8.7 High
jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
- jishenghua jshERP
- Broken access control
- CVSS 5.1 Medium
jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery
- jishenghua jshERP
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
- jishenghua jshERP
- Path traversal
- CVSS 5.1 Medium
jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery
- jishenghua jshERP
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
jishenghua jshERP installByPath install path traversal
- jishenghua jshERP
- Path traversal
- CVSS 5.3 Medium
jishenghua jshERP PluginController uploadPluginConfigFile path traversal
- jishenghua jshERP
- Path traversal
- CVSS 5.3 Medium
jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection
- jishenghua jshERP
- Other injection
- SQL injection