The jshERP system through version 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint. This allows authenticated low-privilege users to change other users' account status, potentially locking out administrators or re-enabling disabled accounts. Defenders responsible for jshERP systems, particularly those with version 3.6 or earlier, should assess exposure and prior [truncated]
A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may b [truncated]
A path traversal vulnerability has been detected in jishenghua jshERP up to 3.6. The vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. This vulnerability allows remote attackers to manipulate the argument fileName, leading to path traversal. The exploit has been dis [truncated]
