PT-2025-35383 · O2Oa · O2Oa

Colorfullbz · Published 2025-08-31 · Updated 2025-08-31 · CVE-2025-9715

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions O2OA versions prior to 10.0-410

Description A cross site scripting issue exists in O2OA. The vulnerability is located in an unknown function of the /x cms assemble control/jaxrs/script file within the Personal Profile Page component. Manipulation of the name, alias, or description argument can trigger the issue. The attack can be launched remotely. The exploit has been made public.

Recommendations Update to a version newer than 10.0-410.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9715

Affected Products

O2Oa

References · 10

• 🔥 https://github.com/o2oa/o2oa/issues/181 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/181#issue-3332967944 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/181#issuecomment-3212879547 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9715 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9715 · Vendor Advisory
• https://vuldb.com/?submit.637243 · Note
• https://vuldb.com/?ctiid.322003 · Note
• https://t.me/CVEtracker/31347 · Telegram Post
• https://vuldb.com/?id.322003 · Note
• https://twitter.com/CVEnew/status/1961984015084261633 · Twitter Post