PT-2025-37267 · Unknown · Erjinzhi 10Oa

Zre0X1C · Published 2025-09-11 · Updated 2025-10-02 · CVE-2025-10272

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: erjinzhi 10OA version 1.0

Description: A vulnerability exists in erjinzhi 10OA version 1.0. The issue involves cross site scripting caused by manipulation of the Name argument in an unknown function of the /trial/mvc/catalogue file. This manipulation can be initiated remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations: As a temporary workaround, consider restricting access to the /trial/mvc/catalogue file to minimize the risk of exploitation. Sanitize the Name argument to prevent the injection of malicious scripts. Disable or remove the vulnerable function if it is not essential for the application's functionality.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-10272

Affected Products

Erjinzhi 10Oa

References · 8

• 🔥 https://github.com/1276486/CVE/issues/6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-10272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10272 · Security Note
• https://vuldb.com/?ctiid.323642 · Note
• https://vuldb.com/?id.323642 · Note
• https://twitter.com/CVEnew/status/1966282865131282890 · Twitter Post
• https://vuldb.com/?submit.643033 · Note
• https://t.me/cveNotify/137237 · Telegram Post