CVE-2025-67344

Impact

jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/jishenghua/jshERP/issues/140