# Jishenghua jshERP vulnerabilities Source: https://junglewise.ai/threats/technologies/jsherp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/jsherp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Jishenghua jshERP: 0 in the last 7 days and 20 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110615, was published on 14 October 2026. 11 vulnerabilities in the last four weeks, up 22% on the four before (9). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 20 - All time: 31 (1 critical, 0 exploited in the wild) ## About Jishenghua jshERP Java-based enterprise resource planning system with modules for sales, inventory, and accounting. ## Latest Jishenghua jshERP vulnerabilities - [CVE-2026-110615: jshERP missing authorization in user status batch update](https://junglewise.ai/threats/cve-2026-110615-jsherp-through-3-6-contains-a-missing-authorization) (high, CVSS 7.1, published 14 Oct 2026) - [CVE-2026-109188: jshERP missing authorization in master data endpoints](https://junglewise.ai/threats/cve-2026-109188-jsherp-through-3-6-contains-a-missing-authorization) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109187: jshERP information disclosure in platform configuration](https://junglewise.ai/threats/cve-2026-109187-jsherp-through-3-6-contains-an-information-disclosure) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109186: jshERP mass assignment vulnerability in UserController](https://junglewise.ai/threats/cve-2026-109186-jsherp-through-3-6-contains-a-mass-assignment-vulnerability-in) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109185: jshERP authorization bypass in UserController updateUser](https://junglewise.ai/threats/cve-2026-109185-jsherp-through-3-6-contains-a-missing-authorization) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109184: jshERP improper authorization in accounting endpoints](https://junglewise.ai/threats/cve-2026-109184-jsherp-through-3-6-contains-an-improper-authorization) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109183: jshERP authorization bypass in bill creation](https://junglewise.ai/threats/cve-2026-109183-jsherp-through-3-6-contains-an-authorization-bypass) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109182: jshERP authorization bypass in supplier export](https://junglewise.ai/threats/cve-2026-109182-jsherp-through-3-6-contains-an-incorrect-authorization) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109181: jshERP authorization bypass in depot management](https://junglewise.ai/threats/cve-2026-109181-jsherp-through-3-6-contains-an-authorization-bypass) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109179: jshERP missing authorization in LogController](https://junglewise.ai/threats/cve-2026-109179-jsherp-through-3-6-contains-a-missing-authorization) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109178: jshERP missing authorization in LogController](https://junglewise.ai/threats/cve-2026-109178-jsherp-through-3-6-contains-a-missing-authorization) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-105621: jishenghua jshERP improper authorization in financial receipt update](https://junglewise.ai/threats/cve-2026-105621-a-security-flaw-has-been-discovered-in-jishenghua-jsherp-up-to-3) (medium, CVSS 5.4, published 6 Oct 2026) - [CVE-2026-94501: jshERP authorization bypass in userBusiness CRUD](https://junglewise.ai/threats/cve-2026-94501-jsherp-through-3-6-contains-an-authorization-bypass-vulnerability) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-94497: jshERP broken object-level authorization in CRUD endpoints](https://junglewise.ai/threats/cve-2026-94497-jsherp-through-3-6-fails-to-validate-object-ownership-in-by-id) (high, CVSS 8.3, published 21 Sep 2026) - [CVE-2026-94496: jshERP privilege escalation in role management endpoints](https://junglewise.ai/threats/cve-2026-94496-jsherp-through-3-6-fails-to-validate-caller-permissions-in-role) (high, CVSS 8.3, published 21 Sep 2026) - [CVE-2026-94495: jshERP privilege validation bypass in systemConfig](https://junglewise.ai/threats/cve-2026-94495-jsherp-through-3-6-fails-to-properly-validate-user-privileges-in) (high, CVSS 7.1, published 21 Sep 2026) - [CVE-2026-94494: jshERP tenant isolation bypass via GET /tenant/info](https://junglewise.ai/threats/cve-2026-94494-jsherp-through-3-6-contains-a-tenant-isolation-bypass) (medium, CVSS 5, published 21 Sep 2026) - [CVE-2026-94413: jshERP password hash disclosure in /user/info endpoint](https://junglewise.ai/threats/cve-2026-94413-jsherp-through-3-6-fails-to-redact-password-hashes-in-the-user) (medium, CVSS 6.5, published 21 Sep 2026) - [CVE-2026-94412: jshERP authorization bypass in password reset](https://junglewise.ai/threats/cve-2026-94412-jsherp-through-3-6-contains-an-authorization-bypass-vulnerability) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-94411: jshERP privilege escalation in updateOneValueByKeyIdAndType](https://junglewise.ai/threats/cve-2026-94411-jsherp-3-6-contains-a-privilege-escalation-vulnerability-in-the) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-11469: jishenghua jshERP SSRF in platformConfig Add Endpoint](https://junglewise.ai/threats/cve-2026-11469-jishenghua-jsherp-ssrf-in-platformconfig-add-endpoint) (medium, CVSS 4.7, published 8 Jun 2026) - [CVE-2026-11467: jishenghua jshERP path traversal in addAccountHeadAndDetail](https://junglewise.ai/threats/cve-2026-11467-jishenghua-jsherp-path-traversal-in-addaccountheadanddetail) (medium, CVSS 5.4, published 8 Jun 2026) - [CVE-2026-8320: jishenghua jshERP SSRF in updatePlatformConfigByKey](https://junglewise.ai/threats/cve-2026-8320-jishenghua-jsherp-ssrf-in-updateplatformconfigbykey) (medium, CVSS 4.7, published 11 May 2026) - [CVE-2025-67344: jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.](https://junglewise.ai/threats/cve-2025-67344-jsherp-v3-5-and-earlier-is-affected-by-a-stored-cross-site) (medium, CVSS 4.6, published 12 Dec 2025) - [CVE-2025-67341: jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to…](https://junglewise.ai/threats/cve-2025-67341-jsherp-versions-3-5-and-earlier-are-affected-by-a-stored-xss) (medium, CVSS 4.6, published 12 Dec 2025) ## Most severe Jishenghua jshERP vulnerabilities - [CVE-2025-51742: An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes…](https://junglewise.ai/threats/cve-2025-51742-an-issue-was-discovered-in-jishenghua-jsh-erp-2-3-1-the-material) (critical, CVSS 9.8, published 25 Nov 2025) - [CVE-2026-94501: jshERP authorization bypass in userBusiness CRUD](https://junglewise.ai/threats/cve-2026-94501-jsherp-through-3-6-contains-an-authorization-bypass-vulnerability) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-94412: jshERP authorization bypass in password reset](https://junglewise.ai/threats/cve-2026-94412-jsherp-through-3-6-contains-an-authorization-bypass-vulnerability) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-94411: jshERP privilege escalation in updateOneValueByKeyIdAndType](https://junglewise.ai/threats/cve-2026-94411-jsherp-3-6-contains-a-privilege-escalation-vulnerability-in-the) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2025-55370: jishenghua jshERP incorrect access control in ResourceController](https://junglewise.ai/threats/cve-2025-55370-jishenghua-jsherp-incorrect-access-control-in-resourcecontroller) (high, CVSS 8.8, published 21 Aug 2025) - [CVE-2025-55368: jishenghua jshERP improper access control in RoleController](https://junglewise.ai/threats/cve-2025-55368-jishenghua-jsherp-improper-access-control-in-rolecontroller) (high, CVSS 8.8, published 21 Aug 2025) - [CVE-2026-109186: jshERP mass assignment vulnerability in UserController](https://junglewise.ai/threats/cve-2026-109186-jsherp-through-3-6-contains-a-mass-assignment-vulnerability-in) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109185: jshERP authorization bypass in UserController updateUser](https://junglewise.ai/threats/cve-2026-109185-jsherp-through-3-6-contains-a-missing-authorization) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-94497: jshERP broken object-level authorization in CRUD endpoints](https://junglewise.ai/threats/cve-2026-94497-jsherp-through-3-6-fails-to-validate-object-ownership-in-by-id) (high, CVSS 8.3, published 21 Sep 2026) - [CVE-2026-94496: jshERP privilege escalation in role management endpoints](https://junglewise.ai/threats/cve-2026-94496-jsherp-through-3-6-fails-to-validate-caller-permissions-in-role) (high, CVSS 8.3, published 21 Sep 2026) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up 22% on the four before (9). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 8 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 11 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Jishenghua jshERP vulnerabilities", https://junglewise.ai/threats/technologies/jsherp, 12 November 2026.