CVE-2025-4531 MEDIUM

CVE-2025-4531: Seeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injection

Vendor Seeyon
Product Zhiyuan OA Web Application System
Weakness CWE-94 · Code injection
Published May 11, 2025
Last update May 12, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template Handler. The manipulation of the argument payrollId leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

May 11, 2025 CVE published
May 12, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-27952 Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE) CVE-2025-15463 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-8254 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2025-49926 WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability CVE-2025-3642 Moodle: authenticated remote code execution risk in the moodle lms equella repository