CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24000
https://notcve.org/view.php?id=CVE-2024-24000
jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths. jshERP v3.3 es vulnerable a la carga arbitraria de archivos. La interfaz jshERP-boot/systemConfig/upload no verifica el tipo de archivo cargado y el parámetro biz se puede empalmar en la ruta de carga, lo que resulta en cargas de archivos arbitrarias con rutas controlables. • https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24000.txt https://github.com/jishenghua/jshERP • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0491 – Huaxia ERP UserController.java password recovery
https://notcve.org/view.php?id=CVE-2024-0491
A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. Upgrading to version 3.2 is able to address this issue. • https://github.com/laoquanshi/puppy/blob/main/Logic%20loopholes%20in%20Huaxia%20ERP%20can%20lead%20to%20unauthorized%20access2.md https://vuldb.com/?ctiid.250596 https://vuldb.com/?id.250596 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0490 – Huaxia ERP getAllList information disclosure
https://notcve.org/view.php?id=CVE-2024-0490
A vulnerability was found in Huaxia ERP up to 3.1. It has been rated as problematic. This issue affects some unknown processing of the file /user/getAllList. The manipulation leads to information disclosure. The attack may be initiated remotely. • https://github.com/laoquanshi/puppy/blob/main/Logic%20loopholes%20in%20Huaxia%20ERP%20can%20lead%20to%20unauthorized%20access.md https://vuldb.com/?ctiid.250595 https://vuldb.com/?id.250595 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-48894
https://notcve.org/view.php?id=CVE-2023-48894
Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function. Vulnerabilidad de control de acceso incorrecto en jshERP V3.3 permite a los atacantes obtener información confidencial a través de la función doFilter. • https://github.com/jishenghua/jshERP/issues/98 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3825 – Huaxia ERP User Management sql injection
https://notcve.org/view.php?id=CVE-2022-3825
A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/Ha0Liu/cveAdd/blob/developer/README.EN.md https://vuldb.com/?id.212792 • CWE-707: Improper Neutralization •