CVE-2026-1546 - Vulnerability Details

- jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection

Description

A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-01-28

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exists in the getBillItemByParam function of com.jsh.erp.datasource.mappers.DepotItemMapperEx. The barCodes argument is concatenated directly into an SQL statement without proper validation, allowing an attacker to inject malicious SQL. This can lead to the execution of arbitrary SQL queries against the database, as stated in the CVE description.

Affected Systems

The affected product is jishenghua jshERP, version 3.6 and all earlier releases. No specific sub‑product or build information is provided, so any installation of jshERP up to and including 3.6 is potentially vulnerable.

Risk and Exploitability

The CVSS score is 5.3, indicating a medium risk level. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation. The description indicates that the attack can be launched remotely, likely via the importItemExcel web endpoint, but no further exploitation prerequisites are described.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

jishenghua

jshERP

affected

Version	Status	Constraints
`3.0`	affected	—
`3.1`	affected	—
`3.2`	affected	—
`3.3`	affected	—
`3.4`	affected	—
`3.5`	affected	—
`3.6`	affected	—

Configuration 1 [-]

cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Jishenghua	Jsherp	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Check the vendor website or repository for updated releases or patches that address the SQL injection in getBillItemByParam.
Restrict network access to the /importItemExcel endpoint by firewall rules or network segmentation to limit exposure of the vulnerable functionality.
Implement input validation to ensure the barCodes parameter conforms to the expected format before it is used in SQL statements.
Configure the database user account used by the application with the least privileges to reduce the impact if injection occurs.

Generated by OpenCVE AI on April 18, 2026 at 19:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00021.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/jishenghua/jshERP/
https://github.com/jishenghua/jshERP/issues/145
https://github.com/jishenghua/jshERP/issues/145#issue-3816930151
https://vuldb.com/?ctiid.343230
https://vuldb.com/?id.343230
https://vuldb.com/?submit.739688

History

Mon, 09 Feb 2026 17:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:jishenghua:jsherp::::::::

Thu, 29 Jan 2026 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 29 Jan 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jishenghua Jishenghua jsherp
Vendors & Products		Jishenghua Jishenghua jsherp

Wed, 28 Jan 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection
Weaknesses		CWE-74 CWE-89
References		https://github.com/jishenghua/jshERP/ https://github.com/jishenghua/jshERP/issues/145 https://github.com/jishenghua/jshERP/issues/145#issue-3816930151 https://vuldb.com/?ctiid.343230 https://vuldb.com/?id.343230 https://vuldb.com/?submit.739688
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Jishenghua Jsherp

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-01-28T22:02:06.131Z

Updated: 2026-02-23T09:02:07.418Z

Reserved: 2026-01-28T15:26:42.326Z

Link: CVE-2026-1546

Vulnrichment

Updated: 2026-01-29T16:01:20.638Z

NVD

Status : Analyzed

Published: 2026-01-28T22:15:55.660

Modified: 2026-02-09T16:58:44.613

Link: CVE-2026-1546

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T20:00:09Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object