CVE-2025-55368

PoC ×2—

CVSS 3.1

8.8 high

EPSS

<1%p32

Published

Aug 21, 2025 (Aug 21, 2025)

Modified

Jul 5, 2026

Description

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

Vendors: jishenghua
Products: jsherp
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.