Total
26 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-55366 | 1 Jishenghua | 1 Jsherp | 2025-09-09 | N/A | 5.3 MEDIUM |
| Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack. | |||||
| CVE-2025-55367 | 1 Jishenghua | 1 Jsherp | 2025-09-09 | N/A | 5.3 MEDIUM |
| Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. | |||||
| CVE-2024-24001 | 1 Jishenghua | 1 Jsherp | 2025-05-15 | N/A | 9.8 CRITICAL |
| jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism. | |||||
| CVE-2024-24003 | 1 Jishenghua | 1 Jsherp | 2025-05-08 | N/A | 9.8 CRITICAL |
| jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection. | |||||
| CVE-2024-24004 | 1 Jishenghua | 1 Jsherp | 2024-11-21 | N/A | 9.8 CRITICAL |
| jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection. | |||||
| CVE-2024-24002 | 1 Jishenghua | 1 Jsherp | 2024-11-21 | N/A | 9.8 CRITICAL |
| jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection. | |||||