Skip to content
Threat Feed
Subscribe

Vendor

JshERP

2 briefs RSS
high advisory

Authorization Bypass in jshERP UserController

jshERP versions through 3.6 contain a missing authorization vulnerability in the UserController updateUser handler, allowing authenticated users to escalate privileges or modify other users' roles.

jshERP web-application-vulnerability privilege-escalation api-security
2t 1c
high advisory

Privilege Escalation in jshERP 3.6 via updateOneValueByKeyIdAndType

jshERP 3.6 contains an improper access control vulnerability in the updateOneValueByKeyIdAndType endpoint allowing authenticated users to escalate privileges to tenant administrator.

jshERP +1 privilege-escalation web-application authorization-bypass idor insecure-direct-object-reference
2r 3t 1c