https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-44034.htmlhttps://patchthecve.com/cve/CVE-2025-44034.htmlWed, 17 Jun 2026 09:24:56 +0000HIGH 8.0: SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrControllerhttps://patchthecve.com/cve/CVE-2025-29592.htmlhttps://patchthecve.com/cve/CVE-2025-29592.htmlWed, 17 Jun 2026 09:05:32 +0000MEDIUM 5.6: oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.https://patchthecve.com/cve/CVE-2025-44033.htmlhttps://patchthecve.com/cve/CVE-2025-44033.htmlWed, 17 Jun 2026 09:24:56 +0000CRITICAL 9.8: SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.javahttps://patchthecve.com/cve/CVE-2025-6829.htmlhttps://patchthecve.com/cve/CVE-2025-6829.htmlWed, 17 Jun 2026 10:02:38 +0000MEDIUM 6.3: A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads to sql injection. The attack may be initiated remotely. This https://patchthecve.com/cve/CVE-2025-5544.htmlhttps://patchthecve.com/cve/CVE-2025-5544.htmlWed, 17 Jun 2026 09:48:08 +0000MEDIUM 4.3: A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. The manipulation leads to path traversal.https://patchthecve.com/cve/CVE-2025-29691.htmlhttps://patchthecve.com/cve/CVE-2025-29691.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.https://patchthecve.com/cve/CVE-2025-29690.htmlhttps://patchthecve.com/cve/CVE-2025-29690.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.https://patchthecve.com/cve/CVE-2025-29689.htmlhttps://patchthecve.com/cve/CVE-2025-29689.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.https://patchthecve.com/cve/CVE-2025-29688.htmlhttps://patchthecve.com/cve/CVE-2025-29688.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.https://patchthecve.com/cve/CVE-2025-29686.htmlhttps://patchthecve.com/cve/CVE-2025-29686.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.https://patchthecve.com/cve/CVE-2025-3392.htmlhttps://patchthecve.com/cve/CVE-2025-3392.htmlWed, 17 Jun 2026 09:19:52 +0000LOW 3.5: A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argument MailNumberId leads to cross site scriphttps://patchthecve.com/cve/CVE-2025-3391.htmlhttps://patchthecve.com/cve/CVE-2025-3391.htmlWed, 17 Jun 2026 09:19:51 +0000LOW 3.5: A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The manipulation of the argument outtype leads tohttps://patchthecve.com/cve/CVE-2025-3390.htmlhttps://patchthecve.com/cve/CVE-2025-3390.htmlWed, 17 Jun 2026 09:19:51 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file cn/gson/oass/controller/daymanager/DaymanageController.java of the component Backend. The manipulation of the argument scheduleList leads to chttps://patchthecve.com/cve/CVE-2025-3389.htmlhttps://patchthecve.com/cve/CVE-2025-3389.htmlWed, 17 Jun 2026 09:19:51 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to croshttps://patchthecve.com/cve/CVE-2025-3388.htmlhttps://patchthecve.com/cve/CVE-2025-3388.htmlWed, 17 Jun 2026 09:19:51 +0000MEDIUM 4.3: A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site schttps://patchthecve.com/cve/CVE-2025-1958.htmlhttps://patchthecve.com/cve/CVE-2025-1958.htmlWed, 17 Jun 2026 08:40:25 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0. This issue affects some unknown processing of the file src/main/resources/mappers/address-mapper.xml. The manipulation of the argument outtype leads to sql injection. The attack may be initiated remotely.