Stored Cross Site Scripting Vulnerability in jshERP by jishenghua
CVE-2025-67344

4.6MEDIUM

Key Information:

Vendor

jishenghua

Status
jshERP
Vendor
CVE Published:
12 December 2025

What is CVE-2025-67344?

The jshERP software, specifically versions up to 3.5, contains a stored Cross Site Scripting (XSS) vulnerability located at the /msg/add endpoint. This flaw allows attackers to inject malicious scripts, which could be executed in the context of an affected user's session. As a result, sensitive information could be compromised or malicious actions performed without the user's consent. It is crucial for users of these versions to implement appropriate security measures and updates to mitigate potential risks.

References

https://github.com/jishenghua/jshERP/issues/140

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.