High · 8.8 CVE-2025-55368 EUVD-2025-25417GHSA-9c44-x77q-mr22

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modif…

Published Aug 21, 2025 · Updated Jul 5, 2026 · Assigned by mitre

Description

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

References

https://github.com/jishenghua/jshERP
https://github.com/cina666/CVE/blob/main/jshERP/CVE-2025-55368.md