JS
Product
jshERP
51
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 10High 16Medium 24Low 1
Watch
Add jshERP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-109187 | 6.5 | Oct 12 | jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey Affected: through 3.6 |
| CVE-2026-94413 | 6.5 | Sep 21 | jshERP through 3.6 Password Hash Disclosure via /user/info Affected: through 3.6 |
| CVE-2025-7948 | 6.5 | Jul 22 | A vulnerability classified as problematic was found in jshERP up to 3.5 Affected: through 3.5 |
| CVE-2026-109178 | 5.4 | Oct 12 | jshERP through 3.6 Missing Authorization via /log Audit Endpoints Affected: through 3.6 |
| CVE-2026-105621 | 5.4 | Oct 6 | jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5 |
| CVE-2026-94414 | 5.4 | Sep 21 | jshERP through 3.6 Missing Authorization via updateBtnStr Affected: through 3.6 |
| CVE-2026-11467 | 5.4 | Jun 7 | jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +1 more |
| CVE-2025-8840 | 5.4 | Aug 11 | A vulnerability was determined in jshERP up to 3.5 Affected: 3.5 |
| CVE-2025-55371 | 5.3 | Aug 21 | Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing… Affected: 3.5 |
| CVE-2025-55367 | 5.3 | Aug 21 | Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any… Affected: 3.5 |
| CVE-2025-55366 | 5.3 | Aug 21 | Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal… Affected: 3.5 |
| CVE-2026-94494 | 5.0 | Sep 21 | jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info Affected: through 3.6 |
| CVE-2026-11469 | 4.7 | Jun 7 | jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +1 more |
| CVE-2026-8320 | 4.7 | May 11 | jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +1 more |
| CVE-2025-67344 | 4.6 | Dec 12 | jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint Affected: through 3.5 |
| CVE-2025-67341 | 4.6 | Dec 12 | jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability Affected: through 3.5 |
| CVE-2026-109188 | 4.3 | Oct 12 | jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints Affected: through 3.6 |
| CVE-2026-109184 | 4.3 | Oct 12 | jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList Affected: through 3.6 |
| CVE-2026-109183 | 4.3 | Oct 12 | jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter Affected: through 3.6 |
| CVE-2026-109182 | 4.3 | Oct 12 | jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel Affected: through 3.6 |
| CVE-2026-109181 | 4.3 | Oct 12 | jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list Affected: through 3.6 |
| CVE-2026-109180 | 4.3 | Oct 12 | jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs Affected: through 3.6 |
| CVE-2026-109179 | 4.3 | Oct 12 | jshERP through 3.6 Missing Authorization via /log/list and /log/info Affected: through 3.6 |
| CVE-2026-1549 | 4.3 | Jan 28 | jishenghua jshERP PluginController uploadPluginConfigFile path traversal Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +1 more |
Showing 24