Medium · 5.3 CVE-2025-55367 EUVD-2025-25426GHSA-5m5m-x2gj-fqpx

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily m…

Published Aug 21, 2025 · Updated Jul 5, 2026 · Assigned by mitre

Description

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

References

https://github.com/jishenghua/jshERP
https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55367.md