11
CVEs
0
Critical
8
High
0
KEV
10
PoC
8
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
8
MEDIUM
2
LOW
1
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-94412 | Authenticated account takeover in jshERP through 3.6 allows any logged-in user to reset the password of any other account, including administrators, by issuing POST /user/resetPwd with an arbitrary target user ID. Because the endpoint performs no ownership or authority check on the supplied user ID and resets the victim's password to a known default value, an attacker holding even the lowest-privilege credentials can seize administrative control of the application. Publicly available exploit code exists (a Python PoC), and while there is no confirmed active exploitation (CISA KEV) or exploitation telemetry, the flaw is trivial to trigger and needs no user interaction, making insider or low-privilege-credential exposure the primary risk. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94501 | Authenticated users can exploit a missing authorization check in jshERP 3.6 and earlier to manipulate userBusiness authorization-relation rows, enabling privilege escalation, access revocation, or role-function modification for any tenant user. Publicly available exploit code exists (POC), and while no active exploitation has been confirmed, the flaw is network-reachable, low-complexity, and requires only a low-privileged account, posing significant risk. The vulnerability is rooted in CWE-862 (Missing Authorization). | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94411 | Privilege escalation in jshERP 3.6 allows an authenticated low-privilege tenant user to grant themselves arbitrary roles, including tenant administrator, by sending a crafted POST request to the updateOneValueByKeyIdAndType endpoint with type=UserRole, their own user ID, and a role ID list. The endpoint applies no ownership or privilege validation (CWE-862), and publicly available exploit code exists. Exploitation requires only a valid low-privilege session; no victim interaction or special configuration is needed, and no CISA KEV listing is present in the provided data to confirm active exploitation. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94496 | Privilege escalation in jshERP through 3.6 lets any authenticated user - including one holding only a low-privileged tenant account (CVSS PR:L, no administrative rights, user interaction, or non-default configuration required) - modify or delete arbitrary role definitions through the /role/update and /role/delete endpoints in RoleController, which perform no caller-permission checks. Successful abuse allows an attacker to widen a role's data scope to 'all data', delete roles, and consequently read every business record in the tenant. Publicly available exploit code exists (a proof-of-concept script has been published); there is no indication of confirmed active exploitation (not in CISA KEV), and no vendor-released fixed version has been identified from the available data, making this a genuine, actionable priority within its limited install base. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94497 | Authenticated users of jshERP through 3.6 can read, modify, and delete other users' business objects - such as materials - by supplying direct object identifiers to by-id info, update, and delete endpoints that lack ownership checks (CWE-639). Exploitation requires a valid low-privileged account (PR:L per the CVSS vector) and network access to the affected API; publicly available exploit code exists, and object IDs are likely enumerable, though CISA KEV does not list active exploitation. With a CVSS 4.0 base score of 8.7, the flaw is a moderate-to-high priority for multi-user or multi-tenant deployments, while single-user instances have little data to expose. | HIGH | 8.7 | 0.3% | 64 |
PoC
No patch
|
| CVE-2026-94413 | jshERP through 3.6 exposes unsalted MD5 password hashes via the /user/info endpoint, allowing any authenticated user to retrieve password digests for arbitrary users by supplying their user IDs. This information disclosure (CWE-200) affects all versions up to 3.6, and publicly available exploit code exists. Attackers with a low-privilege account can enumerate user IDs to obtain hashes, which can be cracked offline to recover plaintext passwords, potentially leading to full account takeover for weak passwords. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting the need for authentication and the high confidentiality impact. | HIGH | 7.1 | 0.3% | 56 |
PoC
No patch
|
| CVE-2026-94495 | Missing authorization in jshERP through version 3.6 lets authenticated low-privilege users rewrite or delete tenant-wide system configuration through the systemConfig endpoint, because SystemConfigService.updateSystemConfig performs no privilege check. Successful abuse corrupts the integrity of company identity, stock rules, approval behavior, and printing configuration, with a secondary risk of disrupting tenant operations; there is no confidentiality exposure reported. Exploitation requires only a valid low-privilege tenant account (no user interaction or non-default configuration), and publicly available exploit code exists, so the practical threat is mainly malicious insiders or holders of compromised or self-registered accounts. Rated 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) and tracked as CWE-862, this is a genuine but moderate-priority issue rather than a critical emergency. | HIGH | 7.1 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-94414 | Authenticated low-privileged users of jshERP through 3.6 can overwrite role button-permission definitions for any role in their tenant by sending arbitrary roleId and btnStr values to the POST /userBusiness/updateBtnStr endpoint, because that handler performs no authorization check on the caller's privileges. Publicly available exploit code exists (a Python POC script is published on GitHub) and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L reflects moderate impact confined to the integrity and availability of permission configuration with no confidentiality exposure; the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
No patch
|
| CVE-2026-94494 | Authenticated tenant isolation bypass in jshERP through 3.6 allows any logged-in user to read other tenants' records from the GET /tenant/info endpoint by iterating tenant primary keys, exposing login names, validity dates, user quotas, and enabled state for every tenant on the platform. Exploitation requires only a valid account of any privilege level (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) and publicly available exploit code exists, though CISA KEV does not list this CVE as actively exploited. Impact is a bounded confidentiality leak - CVSS 5.0 with changed scope but no integrity or availability effect - and only materializes on instances that are genuinely multi-tenant with other tenants' records present; a single-tenant deployment exposes nothing beyond the caller's own data. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
No patch
|
| CVE-2026-110615 | Missing authorization in jshERP through 3.6 lets any authenticated low-privilege user hit POST /user/batchSetStatus and mass-change account status for other users in the same tenant, disabling every non-owner account - including administrator accounts - or re-enabling previously disabled ones. Exploitation requires only a valid low-privilege account and network reachability to the endpoint (CVSS PR:L, no user interaction), which confines realistic risk to insiders or anyone who can obtain low-privilege credentials. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 score of 7.1 (HIGH) and the independent 3.1 assessment (7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) are driven almost entirely by availability impact, with confidentiality untouched and integrity only partially affected. | HIGH | 7.1 | 0.4% | 36 |
No patch
|
| CVE-2026-105621 | Improper authorization (CWE-285) in jshERP through version 3.5 allows an authenticated, low-privileged user to manipulate financial receipt records by invoking the updateAccountHeadAndDetail function in AccountHeadService.java, which fails to enforce proper permission checks. The flaw is remotely exploitable with low attack complexity and no user interaction (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N), but exploitation requires a valid low-privilege account, so the practical risk is insider abuse or misuse of any obtained credentials rather than unauthenticated external compromise. Impact is limited to integrity and availability of financial receipt data (VI:L/VA:L) with no confidentiality exposure, and publicly available exploit code exists (referenced in GitHub issue 167); the vendor was notified via an issue report but has not responded, and no vendor-released patch was identified at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|