Critical 9.3Published Oct 30, 2025

CVE-2021-4461Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass

Updated under an hour ago (Oct 28, 2026, 12:00 AM ET)

Does this affect you?

It affects Seeyon Zhiyuan OA Web Application System. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Seeyon Zhiyuan OA Web Application System

Exploited in the last 30 days

Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Nov 28, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Seeyon Zhiyuan OA Web Application System seeyon:zhiyuan_oa_web_application_system (from the name)	through 7.0 SP1	CNA record

References

References

https://mp.weixin.qq.com/s/0AqdfTrZUVrwTMbKEKresg	exploit
https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml	exploit
https://github.com/projectdiscovery/nuclei-templates/blob/1ca6b8e6fe225cbd46dcb893dcaee01447afa8c0/http/misconfiguration/seeyon-unauth.yaml#L20	exploit
https://www.vulncheck.com/advisories/seeyon-zhiyuan-oa-web-application-system-authentication-bypass	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.