R1bbit
R1bbit Yimioa: vulnerabilidades y CVE
R1bbit Yimioa tiene 11 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE11
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-25589 | Alta (8.1) | 0.49% | — | 18 mar 2025 | An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file. |
| CVE-2025-25586 | Media (4.2) | 0.15% | — | 18 mar 2025 | yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml. |
| CVE-2025-25582 | Media (6.1) | 0.19% | — | 18 mar 2025 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml. |
| CVE-2025-25590 | Media (6.1) | 0.19% | — | 18 mar 2025 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml. |
| CVE-2025-25585 | Alta (7.3) | 0.27% | — | 18 mar 2025 | Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords. |
| CVE-2025-25580 | Media (6.1) | 0.19% | — | 18 mar 2025 | yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml. |
| CVE-2025-1227 | Media (5.3) | 0.53% | — | 12 feb 2025 | A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql… |
| CVE-2025-1226 | Media (6.9) | 0.83% | — | 12 feb 2025 | A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack… |
| CVE-2025-1225 | Media (5.3) | 0.38% | — | 12 feb 2025 | A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the… |
| CVE-2025-1224 | Media (5.3) | 0.42% | — | 12 feb 2025 | A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql… |
| CVE-2025-1216 | Media (5.3) | 0.54% | — | 12 feb 2025 | A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.