CVE-2025-8840CWE-266CWE-285

jshERP Endpoint deleteBatch improper authorization

Medium · published August 11, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00457 · 38.7th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2025-08-11T09:32Z
EPSS history
Timeline
  • 11 AUG 09:32Z
    jshERP Endpoint deleteBatch improper authorization
    cvelistv5