Seeyon vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Seeyon products: 2 record(s), with severity, exploitation and fixes.

A8+ Collaborative Management 1 Zhiyuan OA Web Application System 1

Exploited only (KEV) →

CVE-2025-56451 Medium · 6.1 CWE-79 Jan 16, 2026

Cross-site Scripting (XSS) in Seeyon A8+ Collaborative Management

Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main.do endpoint.

CVE-2021-4461 Critical · 9.3 CWE-306 Oct 30, 2025

Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass

Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.