8.8

CVE-2025-55368

Exploit
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jishenghua ≫ Jsherp Version3.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.315
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://github.com/jishenghua/jshERP
Third Party Advisory
Exploit
http://jsherp.com
Product
https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55368.md
Third Party Advisory
Exploit