OA System

CVEs (4)

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2025-29691	OA System OA System	Med	0.40	6.1	May 14, 2025	A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.
CVE-2025-29690	OA System OA System	Med	0.40	6.1	May 14, 2025	A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.
CVE-2025-29689	OA System OA System	Med	0.40	6.1	May 14, 2025	A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
CVE-2025-29686	OA System OA System	Med	0.40	6.1	May 14, 2025	A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.

CVE-2025-29691MedMay 14, 2025
OA System
OA System
risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.
CVE-2025-29690MedMay 14, 2025
OA System
OA System
risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.
CVE-2025-29689MedMay 14, 2025
OA System
OA System
risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
CVE-2025-29686MedMay 14, 2025
OA System
OA System
risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.