CVE-2025-55366

PoC ×2—

CVSS 3.1

5.3 medium

EPSS

<1%p24

Published

Aug 21, 2025 (Aug 21, 2025)

Modified

Jul 5, 2026

Description

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.

Vendors: jishenghua
Products: jsherp
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.