jshERP vulnerabilities
We track 3 vulnerabilities in jshERP products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 11, 2025.
Latest jshERP vulnerabilities
- 8.8 High severity
jshERP: Incorrect Privilege Assignment
A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has b
- 8.1 High severity
jshERP: Authorization Bypass Through User-Controlled Key
A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch
- 7.2 High severity
jshERP: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main/java/com/jsh/erp/controller/SystemConfigController.java. The manipulation of the argument Title lead