CVE-2024-25320: TONGDA2000 Office Anywhere

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php.

Affected products

• TONGDA2000 Office Anywhere: from 11.0, before 11.10 (fixed in 11.10); version 2017 only

Published 2024-02-16. Last modified 2026-06-17.