A vulnerability was found in jishenghua jshERP up to 3.6 . It has been declared as critical . This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint . Such manipulation of the argument weixinUrl leads to server-side request forgery. This vulnerability is documented as CVE-2026-8320 . The attack can be executed remotely. Additionally, an exploit exists. The project was informed of