CVE Catalog
CVE-2025-51746
CriticalSummary
In JSH_ERP 2.3.1, the /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
Risk Assessment
An attacker could exploit this to take over the ERP system, risking business and operational data.
Recommendation
Update JSH_ERP to the latest version or apply security patches. Restrict access to the mentioned endpoint.
Original NVD description (English source)
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.