A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
References
| Link | Resource |
|---|---|
| https://github.com/o2oa/o2oa/issues/172 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108 | Issue Tracking Vendor Advisory |
| https://vuldb.com/?ctiid.321863 | Permissions Required VDB Entry |
| https://vuldb.com/?id.321863 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.637131 | Third Party Advisory VDB Entry |
Configurations
History
16 Sep 2025, 16:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/o2oa/o2oa/issues/172 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108 - Issue Tracking, Vendor Advisory | |
| References | () https://vuldb.com/?ctiid.321863 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.321863 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.637131 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:a:zoneland:o2oa:*:*:*:*:*:*:*:* | |
| First Time |
Zoneland
Zoneland o2oa |
29 Aug 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-29 15:15
Updated : 2025-09-16 16:34
NVD link : CVE-2025-9655
Mitre link : CVE-2025-9655
CVE.ORG link : CVE-2025-9655
JSON object : View
Products Affected
zoneland
- o2oa