2
CVEs
0
Critical
1
High
0
KEV
1
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
0
LOW
1
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-110615 | Missing authorization in jshERP through 3.6 lets any authenticated low-privilege user hit POST /user/batchSetStatus and mass-change account status for other users in the same tenant, disabling every non-owner account - including administrator accounts - or re-enabling previously disabled ones. Exploitation requires only a valid low-privilege account and network reachability to the endpoint (CVSS PR:L, no user interaction), which confines realistic risk to insiders or anyone who can obtain low-privilege credentials. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 score of 7.1 (HIGH) and the independent 3.1 assessment (7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) are driven almost entirely by availability impact, with confidentiality untouched and integrity only partially affected. | HIGH | 7.1 | 0.4% | 36 |
No patch
|
| CVE-2026-105621 | Improper authorization (CWE-285) in jshERP through version 3.5 allows an authenticated, low-privileged user to manipulate financial receipt records by invoking the updateAccountHeadAndDetail function in AccountHeadService.java, which fails to enforce proper permission checks. The flaw is remotely exploitable with low attack complexity and no user interaction (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N), but exploitation requires a valid low-privilege account, so the practical risk is insider abuse or misuse of any obtained credentials rather than unauthenticated external compromise. Impact is limited to integrity and availability of financial receipt data (VI:L/VA:L) with no confidentiality exposure, and publicly available exploit code exists (referenced in GitHub issue 167); the vendor was notified via an issue report but has not responded, and no vendor-released patch was identified at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|