CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51744

An issue was discovered in jishenghua JSHERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51744: Deserialization of Untrusted Data

An issue was discovered in jishenghua JSHERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51742: Deserialization of Untrusted Data

An issue was discovered in jishenghua JSHERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject, introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads...

CVE-2025-51745: Deserialization of Untrusted Data

An issue was discovered in jishenghua JSHERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51742

The jishenghua JSH_ERP version 2.3.1 is vulnerable to a Fastjson deserialization flaw. The /material/getMaterialEnableSerialNumberList endpoint improperly passes the search query parameter directly to the parseObject() function, which can lead to Remote Code Execution (RCE) via JDBC payloads . Re...

CVE-2025-51743: Deserialization of Untrusted Data

An issue was discovered in jishenghua JSHERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51746: Deserialization of Untrusted Data

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51742

An issue was discovered in jishenghua JSHERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject, introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads...

CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801: Improper Neutralization of Special Elements used in a Command

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP fbda24da and prior versions, which stems from an unauthenticated remote code execution vulnerability in the jsherp function...

CVE-2025-60801

The jshERP (Huaxia ERP) software, a homegrown ERP system, is vulnerable to an unauthenticated remote code execution (RCE) . This flaw exists in versions prior to commit fbda24da due to a vulnerability in the jsh_erp function (also referred to as jsh erp). An attacker can exploit this to execute a...