PT-2025-48085

An issue was discovered in jishenghua JSH ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

PT-2025-48083

An issue was discovered in jishenghua JSH ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51746

CVE-2025-51746 affects jishenghua JSH_ERP 2.3.1. The vulnerability is in the /serialNumber/addSerialNumber endpoint and arises from fastjson deserialization, with CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, CRITICAL). Exploitation details are not provided in the connected docu...

CVE-2025-51744

CVE-2025-51744 affects jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is reported to be vulnerable to fastjson deserialization attacks. The CVSS 3.1 base score is 9.8 (CRITICAL) with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, inte...

CVE-2025-51743

Affected product: jishenghua JSH_ERP 2.3.1. The vulnerability is in the /materialCategory/addMaterialCategory endpoint and is caused by a fastjson deserialization flaw. Impact is described as high in CVSS (CRITICAL, 9.8) with network access, no authentication, and no user interaction. No exploita...

CVE-2025-51742

CVE-2025-51742 affects jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), enabling a Fastjson deserialization vulnerability that can lead to remote code execution via JDBC payloads. No remediation or expl...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. A security vulnerability exists in jshERP version 2.3.1, which stems from the material/getMaterialEnableSerialNumberList endpoint passing search query parameters directly to parseObject, which could...

CVE-2025-51745

CVE-2025-51745 affects jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks due to the deserialization flaw in that endpoint. The CVSS metrics indicate a high-severity, network-exposed chain with no user interaction and total impact on confidential...

PT-2025-48081

An issue was discovered in jishenghua JSH ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject, introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP version 2.3.1, which originates from the serialNumber/addSerialNumber endpoint being vulnerable to Fastjson deserialization attack...

CVE-2025-51742

An issue was discovered in jishenghua JSHERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject, introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads...

PT-2025-48082

An issue was discovered in jishenghua JSH ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks...

PT-2025-48084

An issue was discovered in jishenghua JSH ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. A security vulnerability exists in jshERP version 2.3.1, which originates from the role/addcan endpoint being vulnerable to Fastjson deserialization attack...

CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-63617

ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...

EUVD-2025-50782

ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...

CVE-2025-63617

ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...

CVE-2025-63617

ktg-mes before commit a484f96 2025-07-03 has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data...