[ Vendor · 13 CVEs ]
jishenghua
CVEs affecting jishenghua published in the last 30 days, plus any jishenghua CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110615 | 14 Oct 2026 | CVSS 7.1 | jishenghua jshERPjshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege… | |
| CVE-2026-109186 | 12 Oct 2026 | CVSS 8.8 | jishenghua jshERPjshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite… | |
| CVE-2026-109187 | 12 Oct 2026 | CVSS 6.5 | jishenghua jshERPjshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets… | |
| CVE-2026-109188 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via… | |
| CVE-2026-109181 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list… | |
| CVE-2026-109182 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data… | |
| CVE-2026-109183 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in… | |
| CVE-2026-109184 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account… | |
| CVE-2026-109185 | 12 Oct 2026 | CVSS 8.8 | jishenghua jshERPjshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign… | |
| CVE-2026-109178 | 12 Oct 2026 | CVSS 5.4 | jishenghua jshERPjshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete… | |
| CVE-2026-109179 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation… | |
| CVE-2026-109180 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by… | |
| CVE-2026-105621 | 6 Oct 2026 | CVSS 5.4 | jishenghua jshERPA security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file… |