Medium · 5.3 CVE-2025-55366 EUVD-2025-25427GHSA-h6wg-mx84-h3rv

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account…

Published Aug 21, 2025 · Updated Jul 5, 2026 · Assigned by mitre

Description

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.

References

https://github.com/jishenghua/jshERP
https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55366.md