CVE-2025-1216

CVE-2025-1216 affects the ywoa software and, specifically, the function selectNoticeList in OaNoticeMapper.xml. The root cause is improper handling of the sort argument, enabling SQL injection. The issue enables remote exploitation and has public disclosure. A fix is available: upgrading to versi...

CVE-2025-1227

CVE-2025-1227 affects ywoa up to 2024.07.03, specifically the function selectList in com/cloudweb/oa/mapper/xml/AddressDao.xml. The vulnerability is a SQL injection that can be exploited remotely. Remediation provided in multiple sources is to upgrade to version 2024.07.04. Some entries describe ...

CVE-2025-1224

CVE-2025-1224 affects the ywoa system (up to 2024.07.03) with an SQL injection in the function listNameBySql of com/cloudweb/oa/mapper/xml/UserMapper.xml. The vulnerability arises from how the SQL is constructed in listNameBySql, allowing remote attackers to manipulate queries. Public disclosures...

CVE-2025-1225

CVE-2025-1225 affects ywoa (WXCallBack Interface) with the vulnerability in the extract function of XMLParse.java, enabling an XML External Entity (XXE) reference. The issue is exploitable remotely and impacts the extract component within c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java....

CVE-2025-25586

The CVE-2025-25586 entry relates to yimioa with an information disclosure vulnerability via the /resources/application.yml path, affecting versions prior to v2024.07.04. The standard CVSSv3.1 metrics indicate a Medium base score (4.2) with LOCAL attack vector, HIGH attack complexity, and LOW priv...

CVE-2025-1226

The CVE-2025-1226 entry concerns ywoa up to version 2024.07.03 with a vulnerability in the /oa/setup/setup.jsp file that enables improper authorization, exploitable remotely. Multiple connected sources confirm the issue and public disclosure; upgrade to 2024.07.04 is the remediation. Impact cente...

CVE-2025-25585

CVE-2025-25585 affects yimioa prior to v2024.07.04. The vulnerability is in the component /config/WebSecurityConfig.java and is caused by incorrect access control, enabling unauthorized attackers to arbitrarily modify the administrator password. The CVE details from multiple sources align on this...

CVE-2025-25590

CVE-2025-25590 affects yimioa prior to v2024.07.04, with a SQL injection vulnerability in the component /mapper/xml/AddressDao.xml. The available data confirms the issue and its root cause (SQL injection in AddressDao.xml) without detailing a fixed version or patch. CVSS 3.1 base score is 6.1 (Me...

CVE-2025-25580

CVE-2025-25580 affects yimioa prior to v2024.07.04 and is a SQL injection vulnerability exposed via the listNameBySql() method in the /xml/UserMapper.xml. The entry indicates a local-privilege context with user interaction required and high confidentiality impact, but no exploit details or public...

CVE-2025-25582

CVE-2025-25582 affects yimioa prior to v2024.07.04, with a SQL injection vulnerability in the selectNoticeList() method located at /xml/OaNoticeMapper.xml. The exposed root cause is improper handling of user-supplied input in that mapper, enabling attacker-controlled queries. CVSS 3.1 indicates a...