PT-2025-35393 · O2Oa · O2Oa

Colorfullbz · Published 2025-08-31 · Updated 2025-08-31 · CVE-2025-9719

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions O2OA versions up to 10.0-410

Description A weakness has been identified in O2OA that allows for cross site scripting. The issue affects unknown code within the /x processplatform assemble designer/jaxrs/script file of the Personal Profile Page component. Manipulation of the name, alias, description, or applicationName arguments can be exploited remotely. The exploit has been made publicly available.

Recommendations Versions prior to 10.0-410: As a temporary workaround, consider restricting or disabling the use of the Personal Profile Page component until a fix is available.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9719

Affected Products

O2Oa

References · 9

• 🔥 https://github.com/o2oa/o2oa/issues/185 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/185#issue-3332978174 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9719 · Security Note
• https://twitter.com/CVEnew/status/1962037742939816322 · Twitter Post
• https://vuldb.com/?submit.637247 · Note
• https://vuldb.com/?ctiid.322007 · Note
• https://t.me/CVEtracker/31356 · Telegram Post
• https://vuldb.com/?id.322007 · Note