https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 12:58:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-94497 <p><strong>Affected:</strong> jishenghua jshERP</p> <p>jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users&#39; business objects by submitting direct object identifiers without authorization checks.</p> <p><strong>Affected:</strong> jishenghua jshERP</p> <p>jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users&#39; business objects by submitting direct object identifiers without authorization checks.</p> https://vulnerability.circl.lu/vuln/cve-2026-94497