PT-2025-32534 · Jsherp · Jsherp

Ez-Lbz · Published 2025-08-11 · Updated 2025-08-11 · CVE-2025-8840

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: jshERP versions prior to 3.6

Description: A vulnerability exists in jshERP up to version 3.5. An unknown function within the file /jshERP-boot/user/deleteBatch of the Endpoint component is affected. Manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Recommendations: Versions prior to 3.6 should be updated. As a temporary workaround, restrict access to the /jshERP-boot/user/deleteBatch file to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-8840

Affected Products

Jsherp

References · 11

• 🔥 https://github.com/jishenghua/jshERP/issues/126 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8840 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8840 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1954855845306519792 · Twitter Post
• https://vuldb.com/?ctiid.319374 · Note
• https://vuldb.com/?id.319374 · Note
• https://t.me/cveNotify/131654 · Telegram Post
• https://vuldb.com/?submit.622621 · Note
• https://twitter.com/CVEnew/status/1954842338259341544 · Twitter Post
• https://t.me/CVEtracker/29672 · Telegram Post
• https://vuldb.com/?submit.622573 · Note