CVE-2025-8840: jshERP Endpoint deleteBatch improper authorization

Q: What is the severity of CVE-2025-8840?

CVE-2025-8840 is categorized as a high severity vulnerability due to improper authorization allowing remote attacks.

Q: How do I fix CVE-2025-8840?

To fix CVE-2025-8840, update jshERP to a version later than 3.5 that addresses this vulnerability.

Q: What component is affected by CVE-2025-8840?

CVE-2025-8840 affects the Endpoint component located in the jshERP-boot/user/deleteBatch function.

Q: Can CVE-2025-8840 be exploited remotely?

Yes, CVE-2025-8840 can be exploited remotely due to improper authorization in the affected component.

Q: What software versions are affected by CVE-2025-8840?

CVE-2025-8840 affects jshERP versions up to and including 3.5.

Published Aug 11, 2025

Updated

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.

Affected Software

2 affected components

jshERP jshERP<=3.5

jishenghua jshERP=3.5

Event History

Aug 11, 2025

CVE Published

via MITRE·09:32 AM

Data Sourced

via MITRE·09:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Aug 16, 57827

Event

via FIRST·05:40 PM

Frequently Asked Questions

What is the severity of CVE-2025-8840?

CVE-2025-8840 is categorized as a high severity vulnerability due to improper authorization allowing remote attacks.

How do I fix CVE-2025-8840?

To fix CVE-2025-8840, update jshERP to a version later than 3.5 that addresses this vulnerability.

What component is affected by CVE-2025-8840?