Jishenghua Jsherp 3.5
Approved changes feed: RSS · Atom
cpe:2.3:a:jishenghua:jsherp:3.5:*:*:*:*:*:*:*part: a version: 3.5 update: *
| Vendor | Jishenghua (c82e69bd-5429-5f53-a5f0-3505c786c920) |
|---|---|
| Product | Jsherp (fdd3f04b-b55e-50a6-9fc4-313751c636cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/jishenghua/jsh_erp |
purl2cpe | 2026-06-01 10:13:03.812676 |
pkg:github/jishenghua/jsherp |
purl2cpe | 2026-06-01 10:13:03.812677 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-8840 |
vulnerable | 2026-06-08 07:45:21.302365 |
jshERP Endpoint deleteBatch improper authorization
MEDIUM (5.4)
A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.
Published: 2025-08-11T09:32:05.802Z
Updated: 2025-08-11T12:49:40.283Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8839 |
vulnerable | 2026-06-08 07:45:21.301651 |
jshERP Endpoint addUser improper authorization
MEDIUM (6.3)
A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-08-11T09:02:08.591Z
Updated: 2025-08-11T12:51:21.325Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55371 |
vulnerable | 2026-06-08 07:33:14.732006 |
Details available
Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method.
Published: 2025-08-21T00:00:00.000Z
Updated: 2026-07-05T01:09:58.972Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55370 |
vulnerable | 2026-06-08 07:33:14.731651 |
Details available
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.
Published: 2025-08-21T00:00:00.000Z
Updated: 2026-07-05T01:09:55.093Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55368 |
vulnerable | 2026-06-08 07:33:14.731198 |
Details available
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.
Published: 2025-08-21T00:00:00.000Z
Updated: 2026-07-05T01:09:51.076Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55367 |
vulnerable | 2026-06-08 07:33:14.730814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55366 |
vulnerable | 2026-06-08 07:33:14.730328 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.