CVE-2025-3999

Summary

CVE-2025-3999 is a newly disclosed vulnerability affecting Seeyon Zhiyuan OA Web Application System 8.1 SP2. The issue lies in the handling of URL parameters in the file "date.jsp" located in the ApacheJetspeed component. This vulnerability allows for cross-site scripting attacks, which can be initiated remotely. The manipulation of these parameters can lead to the injection of malicious code, potentially resulting in unauthorized access or data theft. The exploit for this vulnerability has been made public, increasing the risk for potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.