High severity · published Aug 21, 2025
CVE-2025-55370
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jsherp · Jishenghua
3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55370
Exploit
https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%8E%B7%E5%8F%96%E4%BB%BB%E6%84%8F%E8%B4%A6%E5%8F%B7%E4%BF%A1%E6%81%AF%E5%AE%9E%E7%8E%B0%E4%BB%BB%E6%84%8F%E7%99%BB%E5%BD%95.md
Third Party Advisory
https://github.com/jishenghua/jshERP
More from Jsherp
9.8
CVE-2026-1546
jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection
9.8
CVE-2025-51746
An issue was discovered in jishenghua JSH_ERP 2.3.1
9.8
CVE-2025-51745
An issue was discovered in jishenghua JSH_ERP 2.3.1
9.8
CVE-2025-51744
An issue was discovered in jishenghua JSH_ERP 2.3.1
9.8
CVE-2025-51743
An issue was discovered in jishenghua JSH_ERP 2.3.1