CVE-2025-15446 | Seeyon Zhiyuan OA Web Application System up to 20251223 fixedAssetsList.j%73p unitCode sql injection

A vulnerability was found in Seeyon Zhiyuan OA Web Application System up to 20251223. It has been declared as critical. The impacted element is an unknown function of the file /assetsGroupReport/fixedAssetsList.j%73p. Executing manipulation of the argument unitCode can lead to sql injection.

This vulnerability appears as CVE-2025-15446. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.