CVE-2025-67344
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Published Dec 12, 2025 · updated Oct 14, 2026 · jishenghua jsherp
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Dec 12, 2025 · NIST NVD
Detected
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Oct 14, 2026 · NIST NVD
Updated
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
Affected
- cpe jishenghua/jsherpversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2025-67344
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-67344
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2025-67344
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
nvd.nist.gov