CVE-2025-67344

Medium · 4.6

CVSS

4.6

EPSS

0.2%

Published

Dec 12, 2025

CISA due date

—

The record

jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.

Ecosystem	Package	Introduced	Fixed