CVE-2025-8840

Katalog CVE

CVSS 5.4 · Medium EPSS 0,46%

Kerentanan Incorrect Privilege Assignment pada jishenghua jsherp. Skor CVSS 3.1 5.4 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.

Rincian

Terbit di NVD

11 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jishenghua/jshERP/issues/126 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.319374 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.622573 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.622621 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.319374 permissions required · vdb entry