CVE-2026-94413

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94413
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94413.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94413
Published
2026-09-21T18:16:12Z
Modified
2026-09-22T03:31:51Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
jshERP through 3.6 Password Hash Disclosure via /user/info
Details

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94413.json"
}
References

Affected packages

Git / github.com/jishenghua/jsherp

Affected ranges

Type
GIT
Repo
https://github.com/jishenghua/jsherp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
8f28e7c2fe54d54de3621a414f5df1833dc5a55f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0
v1.5
v2.*
v2.0
v2.1
v2.3
v2.3.1
v3.*
v3.0
v3.1
v3.2
v3.3
v3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94413.json"