CVE-2026-1546 | jishenghua jshERP up to 3.6 com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam barCodes sql injection (Issue 145)

A vulnerability was found in jishenghua jshERP up to 3.6. It has been classified as critical. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection.

This vulnerability is traded as CVE-2026-1546. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The project was informed of the problem early through an issue report but has not responded yet.