CVE-2026-94413
jshERP through 3.6 Password Hash Disclosure via /user/info
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 21, 2026
- Updated
- Sep 22, 2026
- Reserved
- Sep 21, 2026
Description
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
jshERPjishenghua |
|
References
- Proof of conceptexploit
- Vulnerable codetechnical-description
- https://github.com/jishenghua/jshERPproduct
- VulnCheck Advisory: jshERP through 3.6 Password Hash Disclosure via /user/infothird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.