← Vulnerability feed

Vulnerability record · CVE-2025-60800 · published 28 October 2025

CVE-2025-60800: Jishenghua jsherp improper access control vulnerability

JJishenghua · Jsherp

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.

7.5 CVSS 3.1 High EPSS 0.30% · top 79.8% CWE-284 · Improper access control
7.5CVSS 3.1 base score
0.30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jishenghua/jshERP/issues/130 ExploitIssue TrackingVendor Advisory

Track CVE-2025-60800 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-51744Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.EPSS 0.48%9.8CVE-2025-51745Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.EPSS 0.48%9.8CVE-2025-51746Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.EPSS 0.48%9.8CVE-2025-51743Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization att…EPSS 0.48%9.8CVE-2025-51742Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter direc…EPSS 0.48%9.8CVE-2024-24003Jishenghua jsherp sql injection vulnerabilityjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount…EPSS 0.80%9.8CVE-2024-24001Jishenghua jsherp sql injection vulnerabilityjshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDeta…EPSS 0.68%9.8CVE-2024-24002Jishenghua jsherp sql injection vulnerabilityjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() func…EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2025-60800), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.