Zhiyuan Oa Web Application System
Approved changes feed: RSS · Atom
cpe:2.3:a:seeyon_(beijing_zhiyuan_internet_software_co.,_ltd.):zhiyuan_oa_web_application_system:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Seeyon (Beijing Zhiyuan Internet Software Co., Ltd.) (ef8aab97-5cea-5ac8-b18a-c1148421ba9f) |
|---|---|
| Product | Zhiyuan Oa Web Application System (cd51059d-43b2-5f83-8974-d3843fcd8359) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-34040 |
vulnerable | 2026-06-08 07:19:02.097717 |
Seeyon Zhiyuan OA System Path Traversal File Upload
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
Published: 2025-06-24T01:12:22.769Z
Updated: 2026-05-14T02:07:28.184Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.