CVE-2025-7947: jshERP Account delete improper authorization
Published Jul 22, 2025
·Updated
A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
2 affected components
jshERP jshERP<=3.5
jishenghua jshERP<=3.5
Event History
Jul 22, 2025
CVE Published
via MITRE·12:32 AM
Data Sourced
via MITRE·12:32 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Jun 18, 58473
Event
via NVD·03:18 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-7947?
CVE-2025-7947 is classified as a critical vulnerability.
2
What are the affected versions regarding CVE-2025-7947?
CVE-2025-7947 affects jshERP versions up to and including 3.5.
3
How can CVE-2025-7947 be exploited?
CVE-2025-7947 can be exploited remotely through improper authorization when manipulating the ID argument in the /user/delete function.
4
What component is impacted by CVE-2025-7947?
CVE-2025-7947 impacts the Account Handler component of jshERP.
5
How do I fix CVE-2025-7947?
To fix CVE-2025-7947, ensure you upgrade jshERP to a version above 3.5.