Repository Issue Activity (beta)

#167 Audited Financial Receipts Can Be Edited In Place Without a Reverse-Audit

#165 Privilege escalation to platform super-admin via mass assignment in /user/update

#161 管理员修改了用户的资料之后，没有办法进行保存。没有保存按钮。

#159 Stored Path Traversal in jshERP via aliOss_linkUrl

#158 [Security] jshERP Role Button Permission BOLA / Privilege Escalation

#157 [Security]

#156 [Security] jshERP <= 3.6 Plugin Installation Leads to Remote Code Execution

#155 [security] Stored SSRF in jshERP-boot

#154 [Security] Stored Path Traversal in jshERP

#153 jshERP vertical privilege escalation via missing authorization in UserBusiness permission relationship APIs

#152 [CVE Request] Admin-to-SSRF via PlatformConfig Modification

#151 [CVE Request] Cross-Tenant Role Ownership Drift via `/role/update` (`tenant_id` writable in SET clause)

#150 启动失败：`platformConfigService` 与 `userService` 双向注入导致 `BeanCurrentlyInCreationException`

#118 登录时，验证码获取失败

#148 如果需要打印的话，显示的列全部都得打印，不能选择列进行打印？

#147 Path traversal causes information leakage in PluginController

#146 Path traversal Vulnerability in PluginController

#145 There is an SQL injection vulnerability in the application

#142 请问数据表的SQL脚本在哪里？

#144 请问为什么在官方网站体验使用超级管理员登录显示密码错误了呢？

#143 有无docker版本？

#141 有没有办法把验证码去掉

#140 /msg/add endpoint is vulnerable to stored XSS attacks

#139 /systemConfig/upload endpoint is vulnerable to stored XSS attacks

#99 There are 4 sql injection vulnerabilities and 1 file upload vulnerability in jshERP v3.3