A security vulnerability has been detected in jishenghua jshERP up to 3.6

An issue was discovered in jishenghua JSH_ERP 2.3.1

An issue was discovered in jishenghua JSH_ERP 2.3.1

An issue was discovered in jishenghua JSH_ERP 2.3.1

An issue was discovered in jishenghua JSH_ERP 2.3.1

An issue was discovered in jishenghua JSH_ERP 2.3.1

jshERP v3.3 is vulnerable to SQL Injection

jshERP v3.3 is vulnerable to SQL Injection

jshERP v3.3 is vulnerable to SQL Injection

jshERP v3.3 is vulnerable to SQL Injection

jshERP through 3.6 Mass Assignment via PUT /user/update

jshERP through 3.6 Privilege Escalation via PUT /user/updateUser

jshERP through 3.6 Privilege Escalation via userBusiness CRUD

jshERP through 3.6 Authorization Bypass via resetPwd

jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the…

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account

A vulnerability was found in jshERP up to 3.5

jshERP through 3.6 Unauthorized Access via by-id Endpoints

jshERP through 3.6 Privilege Escalation via Role Management

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function

A vulnerability classified as critical has been found in jshERP up to 3.5

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request

A vulnerability has been found in jshERP up to 3.5 and classified as critical

jshERP through 3.6 Missing Authorization via /user/batchSetStatus

jshERP through 3.6 Missing Authorization via systemConfig

jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey

jshERP through 3.6 Password Hash Disclosure via /user/info

A vulnerability classified as problematic was found in jshERP up to 3.5

jshERP through 3.6 Missing Authorization via /log Audit Endpoints

jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization

jshERP through 3.6 Missing Authorization via updateBtnStr

jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal

A vulnerability was determined in jshERP up to 3.5

Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing…

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any…

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal…

jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery

jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint

jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability

jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints

jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList

jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter

jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs

jshERP through 3.6 Missing Authorization via /log/list and /log/info

A vulnerability was identified in jishenghua jshERP up to 3.6