CVE-2025-60800

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Oct 28, 2025

CISA due date

—

The record

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.

Affected packages

Ecosystem	Package	Introduced	Fixed