CVE-2025-3389
Low
Description
A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
SeverityLow
CVSS3.5
Exploit probability—
ProductHailey888 Oa System
PublishedApr 8, 2025
First seenApr 8, 2025
Weakness typeCWE-79Cross-site scripting (XSS)CWE-94Code injection
How to fix
Update
- hailey888 oa_system2025.01.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hailey888 oa_system | v < 2025.01.01 | 2025.01.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.