CVE-2025-55368
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In jshERP v3.5, the RoleController.java component has incorrect access control, allowing unauthorized attackers to arbitrarily modify the supplier status under any account.
Risk Assessment
The risk involves unauthorized modification of supplier status, which can disrupt business processes, manipulate data, or lead to privilege escalation.
Recommendation
Immediately update jshERP to the latest version and implement authentication and authorization mechanisms for all supplier management endpoints.
Other vulnerabilities in jshERP
See all- CVE-2026-11469Medium
jishenghua jshERP up to version 3.6 is vulnerable to Server-Side Request Forgery (SSRF) in the insertPlatformConfig function. Manipulating the platformValue argument allows remote attackers to make server-side requests.
- CVE-2026-11467Medium
In jishenghua jshERP up to version 3.6, the addAccountHeadAndDetail function in AccountHeadService.java is vulnerable to path traversal via the fileName argument, allowing a remote attacker to manipulate file paths.
- CVE-2025-55371Medium
In jshERP v3.5, the component PersonController.java has incorrect access control, allowing unauthorized attackers to obtain all handler information by executing the getAllList method.
- CVE-2025-55370High
In jshERP v3.5, the ResourceController.java component has an incorrect access control vulnerability. An unauthorized attacker can obtain all corresponding ID data by modifying the ID value.
- CVE-2025-55367Medium
In jshERP v3.5, the SupplierController.java component has an incorrect access control vulnerability, allowing unauthorized attackers to arbitrarily modify supplier status on any account.
- CVE-2025-55366Medium
In jshERP v3.5, incorrect access control in the UserController.java component allows attackers to arbitrarily reset user account passwords. This vulnerability enables a horizontal privilege escalation attack.
Original NVD description (English source)
Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.