CVE-2026-94412 in jshERP
요약
\~에 의해 MITRE • 2026. 09. 21.
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
If you want to get best quality of vulnerability data, you may have to visit VulDB.