CVE-2025-3391

The CVE-2025-3391 issue affects hailey888 oa_system (versions up to 2025.01.01). The vulnerable component is AddrController.java, function outAddress; improper handling of the outtype parameter enables cross-site scripting (XSS) and the attack can be launched remotely. Exploit publicized. Public ...

CVE-2025-3392

CVE-2025-3392 affects hailey888 oa_system Backend, specifically the Save function in MailController.java. The root cause is manipulation of the MailNumberId argument leading to cross-site scripting. The issue supports remote exploitation and has public exploit material. Public advisories (Red Hat...

CVE-2025-3388

CVE-2025-3388 affects the hailey888 oa_system frontend, specifically the function loginCheck in cn/gson/oasys/controller/login/LoginsController.java . The issue is a cross-site scripting vulnerability caused by manipulation of the Username parameter. The attack can be initiated remotely, and publ...

CVE-2025-3389

The CVE-2025-3389 entry concerns hailey888 oa_system (Backend) with the vulnerable function testMess in InformManageController.java. The issue arises from manipulation of the menu argument, causing cross-site scripting. A remote attacker could exploit it, and public exploit references exist. Conn...

CVE-2025-29686

A cross-site scripting (XSS) vulnerability exists in OA System versions prior to v2025.01.01 . The root cause is the improper neutralization of input for the title parameter within the /inform/InformManageController.java file, which allows an attacker to inject and execute arbitrary web scripts o...

CVE-2025-3390

CVE-2025-3390 affects hailey888 oa_system (Backend) with a flaw in DaymanageController.java:addandchangeday. Manipulation of the argument scheduleList enables cross-site scripting. The vulnerability can be exploited remotely, and the exploit has been disclosed publicly. The product uses a rolling...

CVE-2025-29689

The OA System (an organizational management application) is vulnerable to cross-site scripting (XSS) in versions prior to v2025.01.01 . The root cause is the improper neutralization of input for the password parameter at the /mail/MailController.java endpoint, which allows an attacker to inject a...

CVE-2025-29691

The OA System (an application for day-to-day organizational management) is vulnerable to a cross-site scripting (XSS) flaw in versions prior to v2025.01.01 . The root cause is the improper cleaning of inputs provided to the userName parameter within the /login/LoginsController.java API endpoint. ...

CVE-2025-29688

The OA System (an organizational management application) is vulnerable to a Cross-Site Scripting (XSS) vulnerability in versions prior to v2025.01.01 . The root cause is the improper neutralization of input for the title parameter at the /daymanager/daymanageabilitycontroller.java endpoint, which...

CVE-2025-29690

A cross-site scripting (XSS) vulnerability exists in OA System versions prior to v2025.01.01 . The root cause is the improper cleaning of inputs for the outtype parameter within the /address/AddrController.java file, which allows an attacker to inject and execute arbitrary web scripts or HTML via...