CVE-2025-67341
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.
Published Dec 12, 2025 · updated Oct 14, 2026 · jishenghua jsherp
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Dec 12, 2025 · NIST NVD
Detected
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Oct 14, 2026 · NIST NVD
Updated
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
Affected
- cpe jishenghua/jsherpversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-67341
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-67341
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-67341
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
nvd.nist.gov