Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-1546 SQL Injection in jshERP up to 3.6 via Depot Item Mapper Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1546
Post summary
The text discloses a SQL injection vulnerability in jshERP up to 3.6 via the Depot Item Mapper Function, with no indication of PoC, exploitation, patch, or false positive.
CVE-2026-1546 A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/im… https://www.cve.org/CVERecord?id=CVE-2026-1546
Post summary
The post announces CVE‑2026‑1546 in jishenghua jshERP up to 3.6, identifying the affected function but providing no exploit code, patch, or detailed technical details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jishenghua | jsherp | - | - | - |