CVE-2025-51742

The jishenghua JSH_ERP version 2.3.1 is vulnerable to a Fastjson deserialization flaw. The /material/getMaterialEnableSerialNumberList endpoint improperly passes the search query parameter directly to the parseObject() function, which can lead to Remote Code Execution (RCE) via JDBC payloads . Re...