CVE-2025-67344
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Published Dec 12, 2025 · updated Oct 14, 2026 · jishenghua jsherp
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Timeline
Detection, updates, and resolution for this record.
Dec 12, 2025 · NIST NVD
Detected
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Oct 14, 2026 · NIST NVD
Updated
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Affected
- cpe jishenghua/jsherpversion unspecified
Sources
- CVE.orgCVE-2025-67344
Official CVE identifier
cve.org - NIST NVDCVE-2025-67344
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
nvd.nist.gov