CVE-2025-3391 - hailey888 oa_system Backend AddrController. java outAddress cross site scripting

Back Back to CVE browser

MEDIUM

hailey888 oa_system Backend AddrController. java outAddress cross site scripting

Published Apr 8, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.31%

Description

A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The manipulation of the argument outtype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Affected products

Vendor Hailey888 Product OA System Default
n/a
- Version
  2025.01.01
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hailey888

OA System

n/a

Version	Status	Constraints
2025.01.01	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (3)

https://gitee.com/hailey888/oa_system/issues/IBRRX3
exploitissue-trackingIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.303637
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.303637
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://gitee.com/hailey888/oa_system/issues/IBRRX3		exploitissue-trackingIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.303637		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.303637		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry