2 CVEs publicados el 2026-10-13 · CVSS máximo 8.8/10.
Producto afectado
jshERP 3.6
CVEs de este lote
| CVE | Severidad | CVSS | EPSS | Estado | Descripción |
|---|---|---|---|---|---|
| CVE-2026-109185 | HIGH | 8.8 | — | jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. | |
| CVE-2026-109186 | HIGH | 8.8 | — | jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. |