CVE-2025-8840

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-8840

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8840.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-8840

Published

2025-08-11T09:32:05.802Z

Modified

2026-07-15T01:48:56.638190783Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

jshERP Endpoint deleteBatch improper authorization

Details

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8840.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.4"
                },
                {
                    "last_affected": "3.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ]
}

References

Affected packages

Git / github.com/jishenghua/jsherp

Affected ranges

Type

GIT

Repo

https://github.com/jishenghua/jsherp

Events

Introduced

8b04d9d0076651a592b37a0dced0fcdda0e69d74

Last affected

7ca0f9d68fef761d98b00854d09e975eba291465

Database specific

{
    "cpe": "cpe:2.3:a:jishenghua:jsherp:3.5:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "last_affected": "3.0"
        },
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "3.2"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "3.3"
        },
        {
            "last_affected": "3.3"
        },
        {
            "introduced": "3.5"
        },
        {
            "last_affected": "3.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

3.*

3.0

3.1

3.2

3.3

3.5

v3.*

v3.0

v3.1

v3.2

v3.3

v3.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8840.json"