CVE-2025-3999: Seeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-28 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability, which was classified as problematic, has been found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. This issue affects some unknown processing of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\common\js\addDate\date.jsp of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Seeyon Zhiyuan OA Web Application System: 8.1-sp2

References

https://vuldb.com/?ctiid.306335
https://vuldb.com/?id.306335
https://vuldb.com/?submit.557987
https://wx.mail.qq.com/s?k=-ET_wl44c0s1Drppsy

Get alerted when CVE-2025-3999 or the next vulnerability affects your stack