← Vulnerability feed

Vulnerability record · CVE-2025-60801 · published 24 October 2025

CVE-2025-60801: Jishenghua jsherp command injection vulnerability

JJishenghua · Jsherp

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.

8.2 CVSS 3.1 High EPSS 0.46% · top 62.5% CWE-77 · Command injection
8.2CVSS 3.1 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://fushuling.com/index.php/2025/08/17/%e7%bb%95%e8%bf%87%e8%a1%a5%e4%b8%81%ef%bc%8c%e5%86%8d%e6%ac%a1%e5%ae%9e%e7%8 ExploitThird Party Advisory
https://github.com/jishenghua/jshERP/issues/132 ExploitIssue TrackingVendor Advisory

Track CVE-2025-60801 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-51744Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.EPSS 0.48%9.8CVE-2025-51745Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.EPSS 0.48%9.8CVE-2025-51746Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.EPSS 0.48%9.8CVE-2025-51743Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization att…EPSS 0.48%9.8CVE-2025-51742Jishenghua jsherp deserialization of untrusted data vulnerabilityAn issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter direc…EPSS 0.48%9.8CVE-2024-24003Jishenghua jsherp sql injection vulnerabilityjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount…EPSS 0.80%9.8CVE-2024-24001Jishenghua jsherp sql injection vulnerabilityjshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDeta…EPSS 0.68%9.8CVE-2024-24002Jishenghua jsherp sql injection vulnerabilityjshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() func…EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2025-60801), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.