Vulnerability · Published Aug 11, 2025 · Assigned by VulDB
CVE-2025-8840jshERP Endpoint deleteBatch improper authorization
Medium 5.4
In plain English
A medium-severity security flaw in jshERP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.5%top 57.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.
Affected products (as reported)
Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-319374 | jshERP Endpoint deleteBatch improper authorization vdb-entry, technical-description
- VDB-319374 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #622573 | jishenghua https://github.com/jishenghua/jshERP <=3.5 IDOR(arbitrary account deletion) third-party-advisory
- Submit #622621 | jishenghua https://github.com/jishenghua/jshERP <=3.5 IDOR (Duplicate) third-party-advisory
- https://github.com/jishenghua/jshERP/issues/126 exploit, issue-tracking