PT-2025-44195 · Jsherp · Jsherp

Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-60800

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions jshERP versions prior to commit 90c411a

Description An access control issue exists in the /jshERP-boot/user/info interface of jshERP. An attacker can obtain sensitive information by sending a specially crafted GET request to this interface. The vulnerable code allows unauthorized access to data. The affected component is the /jshERP-boot/user/info API endpoint. The vulnerable request is a GET request.

Recommendations Update jshERP to a version beyond commit 90c411a.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-60800

Affected Products

Jsherp

References · 6

• https://github.com/jishenghua/jshERP/issues/130 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60800 · Security Note
• https://t.me/CVEtracker/35987 · Telegram Post
• https://twitter.com/CVEnew/status/1983230066608972218 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983266767070797992 · Twitter Post