CVE-2025-7948

2.1 lowEPSS 0.4%

Low (2.1) in jishenghua jsherp. EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-640
Published: 2025-07-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jishenghua:jsherp

References

https://github.com/jishenghua/jshERP/issues/123
https://vuldb.com/?ctiid.317089
https://vuldb.com/?id.317089
https://vuldb.com/?submit.619277
https://github.com/jishenghua/jshERP/issues/123

Check your stack JSON