jshERP versions through 3.6 expose unsalted MD5 password hashes via the /user/info endpoint. Any authenticated user can request another user's details by supplying a target user ID, causing the application to return the unchecked MD5 digest of that user's password. The disclosed hash enables attackers to conduct offline brute‑force or dictionary attacks and could be used for direct authentication bypass, compromising confidentiality.

The vulnerability affects the jshERP application from vendor jishenghua, with all releases up to and including version 3.6. It is present in the UserController component that handles the /user/info route; later versions are presumed untainted.

The flaw has a CVSS score of 7.1, placing it in the high severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated, but any valid credential holder can retrieve arbitrary password hashes, creating significant risk for organizations that grant broad access to this endpoint.