CVE-2025-55370
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In jshERP v3.5, the ResourceController.java component has an incorrect access control vulnerability. An unauthorized attacker can obtain all corresponding ID data by modifying the ID value.
Risk Assessment
The risk involves unauthorized access to sensitive ID data, potentially leading to information disclosure and breach of system confidentiality.
Recommendation
Immediately update jshERP to the latest version and implement proper authorization and access validation mechanisms in the ResourceController.
Other vulnerabilities in jshERP
See all- CVE-2026-11469Medium
jishenghua jshERP up to version 3.6 is vulnerable to Server-Side Request Forgery (SSRF) in the insertPlatformConfig function. Manipulating the platformValue argument allows remote attackers to make server-side requests.
- CVE-2026-11467Medium
In jishenghua jshERP up to version 3.6, the addAccountHeadAndDetail function in AccountHeadService.java is vulnerable to path traversal via the fileName argument, allowing a remote attacker to manipulate file paths.
- CVE-2025-55371Medium
In jshERP v3.5, the component PersonController.java has incorrect access control, allowing unauthorized attackers to obtain all handler information by executing the getAllList method.
- CVE-2025-55368High
In jshERP v3.5, the RoleController.java component has incorrect access control, allowing unauthorized attackers to arbitrarily modify the supplier status under any account.
- CVE-2025-55367Medium
In jshERP v3.5, the SupplierController.java component has an incorrect access control vulnerability, allowing unauthorized attackers to arbitrarily modify supplier status on any account.
- CVE-2025-55366Medium
In jshERP v3.5, incorrect access control in the UserController.java component allows attackers to arbitrarily reset user account passwords. This vulnerability enables a horizontal privilege escalation attack.
Original NVD description (English source)
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.