CVE-2025-3390

Summary

CVE-2025-3390 is a newly disclosed vulnerability affecting hailey888's oa_system up to version 2025.01.01. The issue lies in the addandchangeday function of the DaymanageController.java file in the Backend component. Attackers can exploit this cross-site scripting (XSS) vulnerability by manipulating the scheduleList argument. This exploit can be launched remotely, and the code for it has been made public. Hailey888 uses a rolling release model, so no specific version numbers for affected or patched releases have been provided. Users are encouraged to apply the latest updates to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.