Skip to content
Threat Feed
Subscribe

Product

JshERP (<= 3.6)

1 brief RSS
high advisory

Privilege Escalation in jshERP 3.6 via updateOneValueByKeyIdAndType

jshERP 3.6 contains an improper access control vulnerability in the updateOneValueByKeyIdAndType endpoint allowing authenticated users to escalate privileges to tenant administrator.

jshERP +1 privilege-escalation web-application authorization-bypass idor insecure-direct-object-reference
2r 3t 1c