Is there a public PoC exploit available for CVE-2026-8320?

Yes, a public proof-of-concept exploit is available for CVE-2026-8320. Prioritise patching immediately. EPSS: 0.0%.

jishenghua jshERP CVE-2026-8320

Q: What is the CVSS score of CVE-2026-8320?

CVE-2026-8320 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29211 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-11 VulDB

GHSA-8qg6-gq98-w657

SSRF Java

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 20:37 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 20:37 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

May 11, 2026 - 20:30 vuln.today

CVE Published

May 11, 2026 - 19:30 nvd

MEDIUM 4.7

DescriptionCVE.org

A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Server-side request forgery in jshERP up to version 3.6 allows authenticated administrators to manipulate the weixinUrl parameter in the updatePlatformConfigByKey endpoint, enabling remote requests to arbitrary servers. The vulnerability affects the getUserByWeixinCode function in UserService.java and can be exploited remotely by high-privilege users to access internal resources, exfiltrate data, or pivot to backend systems. Publicly available exploit code exists, and the project maintainers have not responded to early disclosure.

Technical ContextAI

The vulnerability stems from improper input validation in the getUserByWeixinCode method within jshERP's UserService component. The updatePlatformConfigByKey endpoint accepts user-controlled weixinUrl parameters without sanitization, allowing attackers to inject arbitrary URLs. This triggers server-side HTTP requests to the specified URL, violating CWE-918 (Server-Side Request Forgery / SSRF). The affected code path processes WeChat integration configurations, a common feature in enterprise resource planning systems. jshERP is a Java-based ERP system that integrates third-party services; the SSRF vulnerability bypasses intended network boundaries and trust assumptions.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate mitigation requires restricting access to the updatePlatformConfigByKey endpoint to only essential system administrators and implementing network-level controls such as outbound firewall rules limiting the jshERP application container to only required external services (e.g., legitimate WeChat API endpoints) and blocking access to internal metadata services and private IP ranges. Additionally, validate and whitelist all weixinUrl inputs against a hardcoded list of legitimate WeChat API domains before processing; reject any URLs containing private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or localhost patterns. Disable or remove unused WeChat integration features if not required for business operations. Monitor outbound HTTP/HTTPS connections from jshERP for anomalous requests to internal or unexpected external hosts. Users should monitor the GitHub repository (https://github.com/jishenghua/jshERP/) and VulDB (https://vuldb.com/vuln/362607) for patch announcements and consider upgrading immediately when a patched version becomes available.