CVE-2026-109186 - jshERP through 3.6 Mass Assignment via PUT /user/update
CVE ID :CVE-2026-109186 Published : Oct. 12, 2026, 1:17 p.m. | 14 minutes ago Description :jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers...