CVE-2025-8840

Name of the Vulnerable Software and Affected Versions: jshERP versions prior to 3.6

Description: A vulnerability exists in jshERP up to version 3.5. An unknown function within the file /jshERP-boot/user/deleteBatch of the Endpoint component is affected. Manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Recommendations: Versions prior to 3.6 should be updated. As a temporary workaround, restrict access to the /jshERP-boot/user/deleteBatch file to minimize the risk of exploitation.