35
CVEs
9
Critical
10
High
0
KEV
29
PoC
19
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
10
MEDIUM
5
LOW
11
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2024-24001 | jshERP v3.3 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-24002 | jshERP v3.3 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2024-24004 | jshERP v3.3 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-24003 | jshERP v3.3 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2025-55368 | Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-55370 | Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-94412 | Authenticated account takeover in jshERP through 3.6 allows any logged-in user to reset the password of any other account, including administrators, by issuing POST /user/resetPwd with an arbitrary target user ID. Because the endpoint performs no ownership or authority check on the supplied user ID and resets the victim's password to a known default value, an attacker holding even the lowest-privilege credentials can seize administrative control of the application. Publicly available exploit code exists (a Python PoC), and while there is no confirmed active exploitation (CISA KEV) or exploitation telemetry, the flaw is trivial to trigger and needs no user interaction, making insider or low-privilege-credential exposure the primary risk. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94501 | Authenticated users can exploit a missing authorization check in jshERP 3.6 and earlier to manipulate userBusiness authorization-relation rows, enabling privilege escalation, access revocation, or role-function modification for any tenant user. Publicly available exploit code exists (POC), and while no active exploitation has been confirmed, the flaw is network-reachable, low-complexity, and requires only a low-privileged account, posing significant risk. The vulnerability is rooted in CWE-862 (Missing Authorization). | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94411 | Privilege escalation in jshERP 3.6 allows an authenticated low-privilege tenant user to grant themselves arbitrary roles, including tenant administrator, by sending a crafted POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID, and a role ID list. The endpoint applies no ownership or privilege validation (CWE-862), and publicly available exploit code exists. Exploitation requires only a valid low-privilege session; no victim interaction or special configuration is needed, and no CISA KEV listing is present in the provided data to confirm active exploitation. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94496 | Privilege escalation in jshERP through 3.6 lets any authenticated user - including one holding only a low-privileged tenant account (CVSS PR:L, no administrative rights, user interaction, or non-default configuration required) - modify or delete arbitrary role definitions through the /role/update and /role/delete endpoints in RoleController, which perform no caller-permission checks. Successful abuse allows an attacker to widen a role's data scope to 'all data', delete roles, and consequently read every business record in the tenant. Publicly available exploit code exists (a proof-of-concept script has been published); there is no indication of confirmed active exploitation (not in CISA KEV), and no vendor-released fixed version has been identified from the available data, making this a genuine, actionable priority within its limited install base. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94497 | Authenticated users of jshERP through 3.6 can read, modify, and delete other users' business objects - such as materials - by supplying direct object identifiers to by-id info, update, and delete endpoints that lack ownership checks (CWE-639). Exploitation requires a valid low-privileged account (PR:L per the CVSS vector) and network access to the affected API; publicly available exploit code exists, and object IDs are likely enumerable, though CISA KEV does not list active exploitation. With a CVSS 4.0 base score of 8.7, the flaw is a moderate-to-high priority for multi-user or multi-tenant deployments, while single-user instances have little data to expose. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94413 | jshERP through 3.6 exposes unsalted MD5 password hashes via the /user/info endpoint, allowing any authenticated user to retrieve password digests for arbitrary users by supplying their user IDs. This information disclosure (CWE-200) affects all versions up to 3.6, and publicly available exploit code exists. Attackers with a low-privilege account can enumerate user IDs to obtain hashes, which can be cracked offline to recover plaintext passwords, potentially leading to full account takeover for weak passwords. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting the need for authentication and the high confidentiality impact. | HIGH | 7.1 | 0.3% | 56 |
PoC
No patch
|
| CVE-2026-94495 | Missing authorization in jshERP through version 3.6 lets authenticated low-privilege users rewrite or delete tenant-wide system configuration through the systemConfig endpoint, because SystemConfigService.updateSystemConfig performs no privilege check. Successful abuse corrupts the integrity of company identity, stock rules, approval behavior, and printing configuration, with a secondary risk of disrupting tenant operations; there is no confidentiality exposure reported. Exploitation requires only a valid low-privilege tenant account (no user interaction or non-default configuration), and publicly available exploit code exists, so the practical threat is mainly malicious insiders or holders of compromised or self-registered accounts. Rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) and tracked as CWE-862, this is a genuine but moderate-priority issue rather than a critical emergency. | HIGH | 7.1 | 0.2% | 56 |
PoC
No patch
|
| CVE-2025-51742 | An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2025-51743 | An issue was discovered in jishenghua JSH_ERP 2.3.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|