https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-25586.htmlhttps://patchthecve.com/cve/CVE-2025-25586.htmlWed, 17 Jun 2026 09:00:55 +0000MEDIUM 4.2: yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.https://patchthecve.com/cve/CVE-2025-25582.htmlhttps://patchthecve.com/cve/CVE-2025-25582.htmlWed, 17 Jun 2026 09:00:55 +0000MEDIUM 6.1: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml.https://patchthecve.com/cve/CVE-2025-25590.htmlhttps://patchthecve.com/cve/CVE-2025-25590.htmlWed, 17 Jun 2026 09:00:55 +0000MEDIUM 6.1: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.https://patchthecve.com/cve/CVE-2025-25585.htmlhttps://patchthecve.com/cve/CVE-2025-25585.htmlWed, 17 Jun 2026 09:00:55 +0000HIGH 7.3: Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords.https://patchthecve.com/cve/CVE-2025-25580.htmlhttps://patchthecve.com/cve/CVE-2025-25580.htmlWed, 17 Jun 2026 09:00:54 +0000MEDIUM 6.1: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.https://patchthecve.com/cve/CVE-2025-1227.htmlhttps://patchthecve.com/cve/CVE-2025-1227.htmlWed, 17 Jun 2026 08:38:38 +0000MEDIUM 6.3: A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the puhttps://patchthecve.com/cve/CVE-2025-1226.htmlhttps://patchthecve.com/cve/CVE-2025-1226.htmlWed, 17 Jun 2026 08:38:38 +0000MEDIUM 5.3: A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may https://patchthecve.com/cve/CVE-2025-1225.htmlhttps://patchthecve.com/cve/CVE-2025-1225.htmlWed, 17 Jun 2026 08:38:38 +0000MEDIUM 6.3: A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity reference.https://patchthecve.com/cve/CVE-2025-1224.htmlhttps://patchthecve.com/cve/CVE-2025-1224.htmlWed, 17 Jun 2026 08:38:38 +0000MEDIUM 6.3: A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to thehttps://patchthecve.com/cve/CVE-2025-1216.htmlhttps://patchthecve.com/cve/CVE-2025-1216.htmlWed, 17 Jun 2026 08:38:37 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely.