medium5.3
CVE-2025-55366
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execu…
Impact
Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jishenghua | Jsherp | Version 3.5 |