Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Seeyon OA A8: Unauthenticated File Writing to Web Application Root

CVE-2019-25714 · published 6 months ago
Summary

An attacker can write files to Seeyon OA A8's web application root without needing a password. This allows an attacker to potentially create malicious files that can be executed, giving them control over the web server. Users should update to the latest version of Seeyon OA A8 to fix this issue.

Original advisory text
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application ro...
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write arbitrary files to the web application root by sending specially crafted POST requests with custom base64-encoded payloads. Attackers can write JSP webshells to the web root and execute them through the web server to achieve arbitrary OS command execution with web server privileges. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-03-26 (UTC).
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published21 Apr 2026
Updated4 Nov 2026
First seen21 Apr 2026
Sources
CVE-2019-25714 · NVD
Track software like this
Free during beta