Jishenghua Jsherp 3.3
Approved changes feed: RSS · Atom
cpe:2.3:a:jishenghua:jsherp:3.3:*:*:*:*:*:*:*part: a version: 3.3 update: *
| Vendor | Jishenghua (c82e69bd-5429-5f53-a5f0-3505c786c920) |
|---|---|
| Product | Jsherp (fdd3f04b-b55e-50a6-9fc4-313751c636cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/jishenghua/jsh_erp |
purl2cpe | 2026-06-01 10:13:03.812673 |
pkg:github/jishenghua/jsherp |
purl2cpe | 2026-06-01 10:13:03.812674 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-24004 |
vulnerable | 2026-06-08 06:29:41.058625 |
Details available
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
Published: 2024-02-06T00:00:00.000Z
Updated: 2024-08-19T20:15:58.487Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24003 |
vulnerable | 2026-06-08 06:29:41.058255 |
Details available
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
Published: 2024-02-08T00:00:00.000Z
Updated: 2025-05-08T18:44:56.754Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24002 |
vulnerable | 2026-06-08 06:29:41.057711 |
Details available
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
Published: 2024-02-06T00:00:00.000Z
Updated: 2024-08-26T19:18:48.047Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-24001 |
vulnerable | 2026-06-08 06:29:41.055955 |
Details available
jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism.
Published: 2024-02-06T00:00:00.000Z
Updated: 2025-05-15T19:45:35.925Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.