CVE-2025-7948

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-640

Affected software

Vendor	Product	Versions
n/a	jshERP	3.0; 3.1; 3.2; 3.3; 3.4; 3.5

References

https://github.com/jishenghua/jshERP/issues/123Exploit, Issue Tracking
https://vuldb.com/?ctiid.317089Permissions Required, VDB Entry
https://vuldb.com/?id.317089Third Party Advisory, VDB Entry
https://vuldb.com/?submit.619277Third Party Advisory, VDB Entry
https://github.com/jishenghua/jshERP/issues/123Exploit, Issue Tracking

Timeline

Published: Jul 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-79496.1A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an u CVE-2025-79509.8A vulnerability was found in code-projects Public Chat Room 1.0. It has been rated as critical. Affected by this issue is some unknown funct CVE-2025-79515.4A vulnerability classified as problematic has been found in code-projects Public Chat Room 1.0. This affects an unknown part of the file /se CVE-2025-79528.8A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the f CVE-2025-79536.1A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown CVE-2025-79548.1A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intend CVE-2025-79559.8The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral CVE-2025-79565.3The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handle CVE-2025-79576.4The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_link_target’ parameter in all versions up CVE-2025-79587.1A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code CVE-2025-79596.4The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up CVE-2025-79606.4The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Cal