jshERP through 3.6 Mass Assignment via PUT /user/update

jshERP through 3.6 Privilege Escalation via PUT /user/updateUser

jshERP through 3.6 Privilege Escalation via userBusiness CRUD

jshERP through 3.6 Authorization Bypass via resetPwd

jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the…

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account

A vulnerability was found in jshERP up to 3.5

jshERP through 3.6 Unauthorized Access via by-id Endpoints

jshERP through 3.6 Privilege Escalation via Role Management

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function

A vulnerability classified as critical has been found in jshERP up to 3.5

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request

A vulnerability has been found in jshERP up to 3.5 and classified as critical

jshERP through 3.6 Missing Authorization via /user/batchSetStatus

jshERP through 3.6 Missing Authorization via systemConfig