CVE-2026-1546

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
jishenghua	jshERP	3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6

References

https://github.com/jishenghua/jshERP/Product
https://github.com/jishenghua/jshERP/issues/145Exploit, Issue Tracking, Vendor Advisory
https://github.com/jishenghua/jshERP/issues/145#issue-3816930151Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.343230Permissions Required, VDB Entry
https://vuldb.com/?id.343230Third Party Advisory, VDB Entry
https://vuldb.com/?submit.739688Third Party Advisory, VDB Entry
https://github.com/jishenghua/jshERP/issues/145Exploit, Issue Tracking, Vendor Advisory
https://github.com/jishenghua/jshERP/issues/145#issue-3816930151Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jan 28, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-154605.4The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data CVE-2026-154615.3The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct CVE-2026-154627.5The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_f CVE-2026-154636.1The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host CVE-2026-154646.4The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versio CVE-2026-15465Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under uns CVE-2026-154667.0Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance co CVE-2026-154678.1A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerab CVE-2026-154686.9Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affe CVE-2026-154697.7The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 CVE-2026-15479.8A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. Th CVE-2026-154704.3A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /ca