CVE-2024-24000

9.8 criticalEPSS 0.6%

Critical (9.8) in huaxiaerp jsherp. EPSS 0.6% chance of exploitation in the next 30 days.

jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2024-02-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

huaxiaerp:jsherp

References

https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24000.txt
https://github.com/jishenghua/jshERP
https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24000.txt
https://github.com/jishenghua/jshERP

Check your stack JSON