PT-2025-35391 · O2Oa · O2Oa

Colorfullbz · Published 2025-08-31 · Updated 2025-08-31 · CVE-2025-9717

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions O2OA versions prior to 10.0-410

Description A vulnerability exists in O2OA that allows for cross site scripting. The issue is related to an unknown functionality within the file /x organization assemble control/jaxrs/unit/ of the Personal Profile Page component. Manipulation of the arguments name, shortName, distinguishedName, pinyin, pinyinInitial, and levelName can trigger the vulnerability. The attack can be launched remotely.

Recommendations Update O2OA to version 10.0-410 or later.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9717

Affected Products

O2Oa

References · 10

• 🔥 https://github.com/o2oa/o2oa/issues/183#issue-3332973239 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/183 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9717 · Security Note
• https://vuldb.com/?id.322005 · Note
• https://vuldb.com/?ctiid.322005 · Note
• https://t.me/cveNotify/133995 · Telegram Post
• https://t.me/CVEtracker/31354 · Telegram Post
• https://vuldb.com/?submit.637245 · Note
• https://twitter.com/CVEnew/status/1962025679072968782 · Twitter Post