j
shERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
References
| Link | Resource |
|---|---|
| https://github.com/jishenghua/jshERP/issues/139 | Exploit Issue Tracking Vendor Advisory |
Configurations
History
19 Dec 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jishenghua jsherp
Jishenghua |
|
| References | () https://github.com/jishenghua/jshERP/issues/139 - Exploit, Issue Tracking, Vendor Advisory | |
| CPE | cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:* |
15 Dec 2025, 18:22
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-12 16:15
Updated : 2025-12-19 20:15
NVD link : CVE-2025-67341
Mitre link : CVE-2025-67341
CVE.ORG link : CVE-2025-67341
JSON object : View
Products Affected
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')