PT-2025-30368 · Jsherp · Jsherp

Zast.Ai · Published 2025-07-22 · Updated 2025-07-30 · CVE-2025-7948

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions jshERP versions up to 3.5

Description A problematic issue exists in jshERP that affects an unknown functionality of the file /jshERP-boot/user/updatePwd. This manipulation results in weak password recovery and can be exploited remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 3.6: Address the weak password recovery issue in the /jshERP-boot/user/updatePwd file.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-7948

Affected Products

Jsherp

References · 10

• 🔥 https://github.com/jishenghua/jshERP/issues/123 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7948 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7948 · Vendor Advisory
• https://vuldb.com/?id.317089 · Note
• https://vuldb.com/?submit.619277 · Note
• https://t.me/cveNotify/130286 · Telegram Post
• https://t.me/cvenotify/129762 · Telegram Post
• https://twitter.com/CVEnew/status/1947494219603468595 · Twitter Post
• https://twitter.com/marcin_brz81183/status/1947539510784352258 · Twitter Post
• https://vuldb.com/?ctiid.317089 · Note