jsherp vulnerabilities and fixes

Recent CVEs affecting jsherp, with upgrade or downgrade steps. 27 tracked.

jsherp has 27 tracked vulnerabilities, 10 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-01-29. Highest priority: CVE-2024-24003 (score 58/100).

• CVE-2025-67341 MEDIUM 4.6 UPGRADE jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability
• CVE-2025-67344 MEDIUM 4.6 UPGRADE jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endp
• CVE-2025-55371 MEDIUM 5.3 DOWNGRADE Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized
• CVE-2025-55370 HIGH 8.8 DOWNGRADE Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthoriz
• CVE-2025-55368 HIGH 8.8 DOWNGRADE Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized a
• CVE-2025-55367 MEDIUM 5.3 DOWNGRADE Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthoriz
• CVE-2025-55366 MEDIUM 5.3 DOWNGRADE Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to a
• CVE-2026-1588 LOW 2.7 UPGRADE A vulnerability was found in jishenghua jshERP up to 3.6
• CVE-2026-1549 MEDIUM 4.3 UPGRADE A vulnerability was identified in jishenghua jshERP up to 3.6
• CVE-2026-1546 MEDIUM 6.3 UPGRADE A security vulnerability has been detected in jishenghua jshERP up to 3.6
• CVE-2025-8840 MEDIUM 5.4 DOWNGRADE A vulnerability was determined in jshERP up to 3.5
• CVE-2025-8839 MEDIUM 6.3 DOWNGRADE A vulnerability was found in jshERP up to 3.5
• CVE-2025-7948 MEDIUM 4.3 UPGRADE A vulnerability classified as problematic was found in jshERP up to 3.5
• CVE-2025-7947 MEDIUM 5.4 UPGRADE A vulnerability classified as critical has been found in jshERP up to 3.5
• CVE-2025-7566 MEDIUM 4.7 UPGRADE A vulnerability has been found in jshERP up to 3.5 and classified as critical
• CVE-2025-60801 HIGH 8.2 UPGRADE jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerab
• CVE-2025-60800 HIGH 7.5 UPGRADE Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attacke
• CVE-2025-51746 CRITICAL 9.8 UPGRADE An issue was discovered in jishenghua JSH_ERP 2.3.1
• CVE-2025-51745 CRITICAL 9.8 UPGRADE An issue was discovered in jishenghua JSH_ERP 2.3.1
• CVE-2025-51744 CRITICAL 9.8 UPGRADE An issue was discovered in jishenghua JSH_ERP 2.3.1
• CVE-2025-51743 CRITICAL 9.8 UPGRADE An issue was discovered in jishenghua JSH_ERP 2.3.1
• CVE-2025-51742 CRITICAL 9.8 UPGRADE An issue was discovered in jishenghua JSH_ERP 2.3.1
• CVE-2024-24004 CRITICAL 9.8 DOWNGRADE jshERP v3.3 is vulnerable to SQL Injection
• CVE-2024-24003 CRITICAL 9.8 DOWNGRADE jshERP v3.3 is vulnerable to SQL Injection
• CVE-2024-24002 CRITICAL 9.8 DOWNGRADE jshERP v3.3 is vulnerable to SQL Injection
• CVE-2024-24001 CRITICAL 9.8 DOWNGRADE jshERP v3.3 is vulnerable to SQL Injection
• CVE-2024-24000 CRITICAL 9.8 DOWNGRADE jshERP v3.3 is vulnerable to Arbitrary File Upload

FAQ

How do I fix jsherp vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is jsherp being exploited right now?

None of the tracked jsherp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which jsherp CVE should I patch first?

CVE-2024-24003 currently ranks highest (58/100): jshERP v3.3 is vulnerable to SQL Injection.

RSS feed for jsherp · ← Back to latest CVEs