CVE-2025-10091 Jinher OA XML Type xml external entity reference

A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possibl...

CVE-2025-10090

A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be us...

CVE-2025-10090 Jinher OA GetTreeDate.aspx sql injection

A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be us...

CVE-2025-10090

Jinher OA contains a SQL injection vulnerability in the GetTreeDate.aspx file (parameter ID). Impact: remote attacker could execute arbitrary SQL; exploit publicly published. Affected versions: up to 1.2 per CVE context; remediation: upgrade to 1.3 or later. Temporary mitigations include restrict...

CVE-2025-10090 Jinher OA GetTreeDate.aspx sql injection

A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be us...

PT-2025-36456

Name of the Vulnerable Software and Affected Versions: Jinher OA versions up to 1.2 Description: A vulnerability exists in Jinher OA that allows for XML external entity reference. The issue impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add with...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from Jinher, a Chinese company. A code issue vulnerability exists in Jinher OA 1.2 and prior versions, which arises from the presence of XML external entity references in the XML Handler component...

Jinher OA SQL注入漏洞

Jinher OA is a collaboration management software from China Jinher Jinher. A SQL injection vulnerability exists in Jinher OA 1.2 and earlier versions, which originates from improper handling of parameters in the /C6/Jhsoft.Web.departments/GetTreeDate.aspx file, which can lead to SQL injection...

CVE-2025-9931

A vulnerability was detected in Jinher OA 1.0. Affected is an unknown function of the file /jc6/platform/sys/login!changePassWord.action of the component POST Request Handler. The manipulation of the argument Account results in cross site scripting. The attack can be launched remotely. The exploi...

Jinher OA 代码注入漏洞

Jinher OA is a collaborative management software from China Jinhe Jinher. Jinher OA 1.0 version of the code injection vulnerability, the vulnerability stems from the file /jc6/platform/sys/login!changePassWord.action in the parameter Account improper operation, which may lead to cross-site...

CVE-2025-9931

CVE-2025-9931 affects Jinher OA 1.0. The flaw is in the POST endpoint at /jc6/platform/sys/login!changePassWord.action within the POST Request Handler, where manipulating the Account parameter triggers cross-site scripting (XSS) . The vulnerability is exploitable remotely and public exploits exis...

CVE-2025-9931 Jinher OA POST Request login!changePassWord.action cross site scripting

A vulnerability was detected in Jinher OA 1.0. Affected is an unknown function of the file /jc6/platform/sys/login!changePassWord.action of the component POST Request Handler. The manipulation of the argument Account results in cross site scripting. The attack can be launched remotely. The exploi...

PT-2025-35847

Name of the Vulnerable Software and Affected Versions: Jinher OA version 1.0 Description: A cross site scripting issue exists due to the manipulation of the Account argument. The issue affects an unknown function within the file /jc6/platform/sys/login!changePassWord.action of the POST Request...

CVE-2025-9669

A vulnerability has been found in Jinher OA 1.0. This issue affects some unknown processing of the file GetTreeDate.aspx. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used...

CVE-2025-9669

A vulnerability has been found in Jinher OA 1.0. This issue affects some unknown processing of the file GetTreeDate.aspx. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used...

CVE-2025-9669

The CVE-2025-9669 entry concerns Jinher OA 1.0. The vulnerability arises in the GetTreeDate.aspx file where manipulation of the ID parameter enables SQL injection. Remote exploitation is possible and the exploit has been publicly disclosed. Connected documents corroborate the presence of a SQL in...

CVE-2025-9669 Jinher OA GetTreeDate.aspx sql injection

A vulnerability has been found in Jinher OA 1.0. This issue affects some unknown processing of the file GetTreeDate.aspx. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used...

CVE-2025-44033

SQL injection vulnerability in oasystem oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java...

Exploit for CVE-2025-34040

CVE-2025-34040:OA’s file upload feature may lead to RCE vulner...

PT-2025-35304

Name of the Vulnerable Software and Affected Versions: Jinher OA version 1.0 Description: A vulnerability exists in the processing of the GetTreeDate.aspx file within Jinher OA. Manipulation of the ID argument results in a SQL injection. Remote exploitation is possible. The exploit has been...