8.8

CVE-2025-55368

Exploit
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jishenghua ≫ Jsherp Version3.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.309
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://github.com/jishenghua/jshERP
Third Party Advisory
Exploit
https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55368.md
Third Party Advisory
Exploit