| Package | Affected versions | Patched versions |
|---|---|---|
| jsherp | = 3.3 |
jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free