CNNVD-202601-4638 Information

Jan 28, 2026 cve

CNNVD ID

CNNVD-202601-4638

CVE-2026-1546

CNNVD Published: 2026-01-28

Description (Chinese)

jshERP（华夏ERP）是中国季圣华个人开发者的一款国产 ERP 系统。 jshERP 3.6及之前版本存在SQL注入漏洞，该漏洞源于对文件/jshERP-boot/depotItem/importItemExcel中getBillItemByParam函数的参数barCodes的错误操作，可能导致SQL注入攻击。

Description (English)

Jsherp (Wahsha ERP) is a nationally produced ERP system for Chinese personal developers in Zhi Sanhua. JsheRP 3.6 and previous versions contain an injection loophole in SQL, which stems from an error in the parameter of the GetBillItemByParam function in file/jsheRP-boot/depotItem/importItemExcel, which could lead to an attack on SQL injection.

Hazard Level

High

Vulnerability Type

SQL注入

Affected Vendor

个人开发者

Published

2026-01-28

Last Modified

2026-02-24

References

https://github.com/jishenghua/jshERP/ https://github.com/jishenghua/jshERP/issues/145 https://github.com/jishenghua/jshERP/issues/145#issue-3816930151 https://vuldb.com/?ctiid.343230 https://vuldb.com/?id.343230 https://vuldb.com/?submit.739688

Share on: