CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51744

An issue was discovered in jishenghua JSHERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

CVE-2025-51742

An issue was discovered in jishenghua JSHERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject, introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads...

CVE-2025-51742

CVE-2025-51742 affects jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), enabling a Fastjson deserialization vulnerability that can lead to remote code execution via JDBC payloads. No remediation or expl...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution RCE vulnerability via the jsherp function...

CVE-2025-60801

The CVE-2025-60801 entry concerns jshERP up to commit fbda24da, with an unauthenticated remote code execution (RCE) via the jsh_erp function. The vulnerability is exploitable over network without authentication, with CVSSv3.1 base metrics indicating high severity (8.2) and impacts to confidential...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP fbda24da and prior versions, which stems from an unauthenticated remote code execution vulnerability in the jsherp function...