CVE-2026-8320

A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-918

• https://github.com/jishenghua/jshERP/
• https://github.com/jishenghua/jshERP/issues/152
• https://vuldb.com/submit/811303
• https://vuldb.com/vuln/362607
• https://vuldb.com/vuln/362607/cti

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-83194Vulnerability in the Oracle Depot Repair product of Oracle E…8.8
• CVE-2026-83195Vulnerability in the Siebel CRM Deployment product of Oracle…7.2
• CVE-2026-83196Vulnerability in the Siebel CRM Deployment product of Oracle…9.1
• CVE-2026-83197Vulnerability in the Siebel Apps - Financial Services produc…9.1
• CVE-2026-83198Vulnerability in the Oracle Field Service product of Oracle …5.4
• CVE-2026-83199Vulnerability in the Siebel CRM Deployment product of Oracle…8.8
• CVE-2026-83200Vulnerability in the Oracle Process Manufacturing Intelligen…6.5
• CVE-2026-83201Vulnerability in the Siebel CRM Deployment product of Oracle…9.1
• CVE-2026-83202Vulnerability in the Siebel CRM Deployment product of Oracle…9.1
• CVE-2026-83203Vulnerability in the Siebel CRM End User product of Oracle S…8.6
• CVE-2026-83204Vulnerability in the Oracle Sourcing product of Oracle E-Bus…7.5
• CVE-2026-83205Vulnerability in the Oracle Applications Framework product o…8.8