CVE-2025-3388
Medium
Description
A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
SeverityMedium
CVSS4.3
Exploit probability—
ProductHailey888 Oa System
PublishedApr 7, 2025
First seenApr 7, 2025
Weakness typeCWE-79Cross-site scripting (XSS)CWE-94Code injection
How to fix
Update
- hailey888 oa_system2025.01.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hailey888 oa_system | v < 2025.01.01 | 2025.01.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.