PT-2025-35416 · O2Oa · O2Oa

Colorfullbz · Published 2025-08-31 · Updated 2025-08-31 · CVE-2025-9735

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions O2OA versions up to 10.0-410

Description A weakness exists in O2OA that allows for cross site scripting. The issue affects an unknown function within the /x query assemble designer/jaxrs/table file of the Personal Profile Page component. Manipulation of the description, applicationName, and queryName arguments can trigger the issue. The attack can be initiated remotely, and the exploit has been publicly released.

Recommendations Versions prior to a new version containing a fix are affected.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9735

Affected Products

O2Oa

References · 10

• 🔥 https://github.com/o2oa/o2oa/issues/187#issue-3332984961 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/187 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9735 · Security Note
• https://vuldb.com/?id.322034 · Note
• https://twitter.com/CVEnew/status/1962181194612883771 · Twitter Post
• https://vuldb.com/?ctiid.322034 · Note
• https://vuldb.com/?submit.637249 · Note
• https://t.me/cveNotify/134004 · Telegram Post
• https://t.me/CVEtracker/31372 · Telegram Post