Jishenghua Jsherp
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Jishenghua Jsherp.
By the Year
In 2026 there have been 15 vulnerabilities in Jishenghua Jsherp with an average score of 6.3 out of ten. Last year, in 2025 Jsherp had 2 security vulnerabilities published. That is, 13 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.96
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 15 | 6.34 |
| 2025 | 2 | 7.30 |
| 2024 | 4 | 9.80 |
It may take a day or so for new Jsherp vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Jishenghua Jsherp Security Vulnerabilities
jshERP 3.6 Auth Bypass in userBusiness CRUD (CVE-2026-94501)
CVE-2026-94501
8.8 - High
- September 21, 2026
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.
AuthZ
jshERP 3.6 Remote Authorization Bypass in By-ID Endpoints
CVE-2026-94497
8.3 - High
- September 21, 2026
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.
Insecure Direct Object Reference / IDOR
jshERP <=3.6 Unchecked permission on /role/update & /role/delete
CVE-2026-94496
8.3 - High
- September 21, 2026
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.
AuthZ
jshERP <3.6 Privilege Escalation via SystemConfigService.updateSystemConfig
CVE-2026-94495
7.1 - High
- September 21, 2026
jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.
AuthZ
jshERP 3.6 Tenant Isolation Bypass via GET /tenant/info
CVE-2026-94494
5 - Medium
- September 21, 2026
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.
Insecure Direct Object Reference / IDOR
jshERP 3.6 Auth Bypass on /userBusiness/updateBtnStr (CVE-2026-94414)
CVE-2026-94414
5.4 - Medium
- September 21, 2026
jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.
AuthZ
jshERP 3.6 Authenticated Password Hash Exposure in /user/info (MD5)
CVE-2026-94413
6.5 - Medium
- September 21, 2026
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.
Information Disclosure
jshERP <3.6 Auth Bypass: POST /user/resetPwd resets other users' passwords
CVE-2026-94412
8.8 - High
- September 21, 2026
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
AuthZ
jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
CVE-2026-94411
8.8 - High
- September 21, 2026
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.
AuthZ
jshERP SSRF via insertPlatformConfig before 3.6
CVE-2026-11469
4.7 - Medium
- June 07, 2026
A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
SSRF
jshERP <=3.6 Path Traversal via addAccountHeadAndDetail fileName
CVE-2026-11467
5.4 - Medium
- June 07, 2026
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Directory traversal
jishenghua jshERP <=3.6 SSRF via updatePlatformConfigByKey Endpoint
CVE-2026-8320
4.7 - Medium
- May 11, 2026
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
SSRF
jishenghua jshERP <=3.6 Path Traversal via installByPath
CVE-2026-1588
2.7 - Low
- January 29, 2026
A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Directory traversal
CVE-2026-1549 jshERP 3.6 PT via /uploadPluginConfigFile
CVE-2026-1549
4.3 - Medium
- January 28, 2026
A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Directory traversal
SQLi in jshERP (3.6) getBillItemByParam via barCodes
CVE-2026-1546
6.3 - Medium
- January 28, 2026
A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
SQL Injection
jshERP 3.5 Account Handler ID RCE via /user/delete (Critical)
CVE-2025-7947
8.1 - High
- July 22, 2025
A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Insecure Direct Object Reference / IDOR
jshERP 3.5 Weak Password Recovery Remote Exploit
CVE-2025-7948
6.5 - Medium
- July 22, 2025
A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Weak Password Recovery Mechanism for Forgotten Password
SQLI in jshERP v3.3 via DepotHeadController findInOutMaterialCount
CVE-2024-24003
9.8 - Critical
- February 08, 2024
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
SQL Injection
jshERP v3.3 SQLi in DepotHeadController via column/order param
CVE-2024-24004
9.8 - Critical
- February 07, 2024
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
SQL Injection
jshERP 3.3 SQL Injection via DepotHeadController
CVE-2024-24001
9.8 - Critical
- February 07, 2024
jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism.
SQL Injection
jshERP v3.3 SQLi via unsanitized column/order params
CVE-2024-24002
9.8 - Critical
- February 07, 2024
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
SQL Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Jishenghua Jsherp or by Jishenghua? Click the Watch button to subscribe.
