CVE-2025-67341
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.
Published Dec 12, 2025 · updated Oct 14, 2026 · jishenghua jsherp
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Timeline
Detection, updates, and resolution for this record.
Dec 12, 2025 · NIST NVD
Detected
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Oct 14, 2026 · NIST NVD
Updated
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Affected
- cpe jishenghua/jsherpversion unspecified
Sources
- CVE.orgCVE-2025-67341
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-67341
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2025-67341
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
nvd.nist.gov