CVE-2025-60801

8.2 HIGH
Published: October 24, 2025 Modified: November 05, 2025
View on NVD

Description

jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://fushuling.com/index.php/2025/08/17/%e7%bb%95%e8%bf%87%e8%a1%a5%e4%b8%81%ef%bc%8c%e5%86%8d%e6%ac%a1%e5%ae%9e%e7%8e%b0%e5%8d%8e%e5%a4%8ferp%e6%9c%aa%e6%8e%88%e6%9d%83rce%e5%b7%b2%e4%bf%ae%e5%a4%8d/
Source: cve@mitre.org
Exploit Third Party Advisory
https://github.com/jishenghua/jshERP/issues/132
Source: cve@mitre.org
Exploit Issue Tracking Vendor Advisory

2 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.2 / 10.0
EPSS (Exploit Probability)
0.2%
37th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-77

Affected Vendors

jishenghua

Related CVEs

CVE-2025-69261 N/A
CVE-2025-69257 6.7
CVE-2025-69210 N/A
CVE-2025-66823 N/A
CVE-2025-50343 N/A