A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
References
| Link | Resource |
|---|---|
| https://github.com/o2oa/o2oa/issues/172 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108 | Issue Tracking Vendor Advisory |
| https://vuldb.com/?ctiid.321863 | Permissions Required VDB Entry |
| https://vuldb.com/?id.321863 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.637131 | Third Party Advisory VDB Entry |
Configurations
History
16 Sep 2025, 16:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:zoneland:o2oa:*:*:*:*:*:*:*:* | |
| First Time |
Zoneland
Zoneland o2oa |
|
| References | () https://github.com/o2oa/o2oa/issues/172 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108 - Issue Tracking, Vendor Advisory | |
| References | () https://vuldb.com/?ctiid.321863 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.321863 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.637131 - Third Party Advisory, VDB Entry |
29 Aug 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-29 15:15
Updated : 2025-09-16 16:34
NVD link : CVE-2025-9655
Mitre link : CVE-2025-9655
CVE.ORG link : CVE-2025-9655
JSON object : View
Products Affected
zoneland
- o2oa