CVE-2026-109181

The jshERP software, versions through 3.6 , is affected by an authorization bypass vulnerability. An authenticated user restricted to personal or department data can access other users' bills by including a purchaseStatus=0 value in the search JSON on the GET /depotHead/list endpoint. This input ...

EUVD-2026-97385

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...

CVE-2026-109181 jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing...

CVE-2022-3826: Incorrect Privilege Assignment

A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retail Management. The manipulation of the argument search leads to information disclosure. It is possible to initiate the attack remotely. The...

PT-2022-24319 · Unknown · Huaxia Erp

Name of the Vulnerable Software and Affected Versions: Huaxia ERP affected versions not specified Description: A problematic issue has been found in Huaxia ERP, affecting an unknown part of the file /depotHead/list of the Retail Management component. The manipulation of the search argument leads ...