CVE-2025-8839 jshERP Endpoint addUser improper authorization

A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may b...

PT-2025-32534 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP versions prior to 3.6 Description: A vulnerability exists in jshERP up to version 3.5. An unknown function within the file /jshERP-boot/user/deleteBatch of the Endpoint component is affected. Manipulation of the argument ids leads to...

PT-2025-32532 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP versions prior to 3.6 Description: A flaw exists in jshERP up to version 3.5 related to improper authorization. The issue affects unknown processing of the file /jshERP-boot/user/addUser within the Endpoint component. This manipulation...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP Huaxia ERP version 3.5 and earlier, which originates from an authorization flaw due to improper handling of parameter ids in file /jshERP-boot/user/deleteBat...

CVE-2025-7947

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7948

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2025-7948

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2025-7947

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7948 jshERP updatePwd password recovery

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2025-7948

CVE-2025-7948 affects jshERP up to version 3.5. The vulnerability is due to a weakness in the handling of the file /jshERP-boot/user/updatePwd, leading to weak password recovery. It can be exploited remotely and the exploit has been publicly disclosed. Affected versions are up to 3.5; remediation...

CVE-2025-7948 jshERP updatePwd password recovery

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2025-7948 jshERP updatePwd password recovery

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2025-7947 jshERP Account delete improper authorization

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7947 jshERP Account delete improper authorization

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7947

CVE-2025-7947 affects jshERP (up to version 3.5). The vulnerability targets an unknown function in the file /user/delete of the Account Handler, where argument ID manipulation leads to improper authorization. It is exploitable remotely and the exploit has been disclosed publicly. Multiple connect...

CVE-2025-7947 jshERP Account delete improper authorization

A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has...

PT-2025-30364 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP versions prior to 3.5 Description: A critical issue exists in jshERP. The issue involves improper authorization due to the manipulation of the ID argument within an unknown function of the /user/delete file in the Account Handler...

PT-2025-30368 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP versions up to 3.5 Description: A problematic issue exists in jshERP that affects an unknown functionality of the file /jshERP-boot/user/updatePwd. This manipulation results in weak password recovery and can be exploited remotely. The...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Shenghua in China. A security vulnerability exists in jshERP 3.5 and earlier versions, which stems from improper authorization due to incorrect manipulation of the parameter ID in the file /user/delete...

CVE-2025-7566

A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main/java/com/jsh/erp/controller/SystemConfigController.java. The manipulation of the argument Title leads to path traversal. The attack can b...