https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-29691.htmlhttps://patchthecve.com/cve/CVE-2025-29691.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.https://patchthecve.com/cve/CVE-2025-29690.htmlhttps://patchthecve.com/cve/CVE-2025-29690.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.https://patchthecve.com/cve/CVE-2025-29689.htmlhttps://patchthecve.com/cve/CVE-2025-29689.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.https://patchthecve.com/cve/CVE-2025-29688.htmlhttps://patchthecve.com/cve/CVE-2025-29688.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.https://patchthecve.com/cve/CVE-2025-29686.htmlhttps://patchthecve.com/cve/CVE-2025-29686.htmlWed, 17 Jun 2026 09:05:35 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.https://patchthecve.com/cve/CVE-2025-3392.htmlhttps://patchthecve.com/cve/CVE-2025-3392.htmlWed, 17 Jun 2026 09:19:52 +0000LOW 3.5: A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argument MailNumberId leads to cross site scriphttps://patchthecve.com/cve/CVE-2025-3391.htmlhttps://patchthecve.com/cve/CVE-2025-3391.htmlWed, 17 Jun 2026 09:19:51 +0000LOW 3.5: A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The manipulation of the argument outtype leads tohttps://patchthecve.com/cve/CVE-2025-3390.htmlhttps://patchthecve.com/cve/CVE-2025-3390.htmlWed, 17 Jun 2026 09:19:51 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file cn/gson/oass/controller/daymanager/DaymanageController.java of the component Backend. The manipulation of the argument scheduleList leads to chttps://patchthecve.com/cve/CVE-2025-3389.htmlhttps://patchthecve.com/cve/CVE-2025-3389.htmlWed, 17 Jun 2026 09:19:51 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to croshttps://patchthecve.com/cve/CVE-2025-3388.htmlhttps://patchthecve.com/cve/CVE-2025-3388.htmlWed, 17 Jun 2026 09:19:51 +0000MEDIUM 4.3: A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site sc