Aaluoxiang vulnerabilities
We track 6 vulnerabilities in Aaluoxiang products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2025.
Latest Aaluoxiang vulnerabilities
- 8.0 High severity
Oa System: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController
- 9.8 Critical severity
Oa System: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java
- 8.8 High severity
oa_system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads to sql injection. The
- 7.5 High severity
oa_system: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as problematic has been found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. This affects the function image of the file src/main/java/cn/gson/oasys/controller/process/ProcedureController.java. The manipulati
- 7.5 High severity
oa_system: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. T
- 9.8 Critical severity
oa_system: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0. This issue affects some unknown processing of the file src/main/resources/mappers/address-mapper.xml. The manipulation of the argument outtype leads to sql injection