← All advisories

Medium severity4.6OSV Advisory· Published Dec 12, 2025· Updated Jun 17, 2026

CVE-2025-67344

CVE-2025-67344

Description

jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

jshERP/jshERP3 versions
cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*range: <=3.5
- (no CPE)range: <=3.5
- (no CPE)range: v1.0, v1.5, v2.0, …

Patches

Vulnerability mechanics

References

1

github.com/jishenghua/jshERP/issues/140nvdExploitIssue TrackingVendor Advisory

News mentions

0

No linked articles in our index yet.