PT-2025-35415 · O2Oa · O2Oa

Colorfullbz · Published 2025-08-31 · Updated 2025-08-31 · CVE-2025-9734

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions O2OA versions up to 10.0-410

Description A security flaw exists in O2OA up to version 10.0-410. The issue is related to cross site scripting within the Personal Profile Page component, specifically affecting an unknown function of the file /x query assemble designer/jaxrs/stat. Manipulation of the name, alias, description, or applicationName argument can trigger the flaw. The attack can be launched remotely, and the exploit has been publicly released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9734

Affected Products

O2Oa

References · 11

• 🔥 https://github.com/o2oa/o2oa/issues/186#issue-3332982474 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/186#issuecomment-3212875321 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/186 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9734 · Security Note
• https://vuldb.com/?ctiid.322033 · Note
• https://t.me/CVEtracker/31371 · Telegram Post
• https://vuldb.com/?id.322033 · Note
• https://t.me/cveNotify/134003 · Telegram Post
• https://vuldb.com/?submit.637248 · Note
• https://twitter.com/CVEnew/status/1962176069756465409 · Twitter Post