PT-2025-35417 · O2Oa · O2Oa

Colorfullbz · Published 2025-08-31 · Updated 2025-08-31 · CVE-2025-9736

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions O2OA versions up to 10.0-410

Description A security issue has been identified in O2OA that allows for cross site scripting. The issue impacts an unknown function within the /x query assemble designer/jaxrs/statement file of the Personal Profile Page component. Manipulation of the queryName argument within the description parameter can be used to exploit this issue. The attack can be launched remotely. The exploit has been publicly disclosed.

Recommendations Update to a newer version to address this issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9736

Affected Products

O2Oa

References · 11

• 🔥 https://github.com/o2oa/o2oa/issues/188#issue-3332988434 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/188 · Exploit
• 🔥 https://github.com/o2oa/o2oa/issues/188#issuecomment-3212698441 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9736 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9736 · Vendor Advisory
• https://vuldb.com/?id.322035 · Note
• https://t.me/CVEtracker/31373 · Telegram Post
• https://vuldb.com/?ctiid.322035 · Note
• https://twitter.com/CVEnew/status/1962192835140325726 · Twitter Post
• https://vuldb.com/?submit.637250 · Note
• https://t.me/cveNotify/134005 · Telegram Post