CVE-2025-9716

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	O2OA	10.0-410

References

https://github.com/o2oa/o2oa/issues/182Exploit, Issue Tracking
https://github.com/o2oa/o2oa/issues/182#issue-3332970310Exploit, Issue Tracking
https://github.com/o2oa/o2oa/issues/182#issuecomment-3212879158Exploit, Issue Tracking
https://vuldb.com/?ctiid.322004Permissions Required, VDB Entry
https://vuldb.com/?id.322004Third Party Advisory, VDB Entry
https://vuldb.com/?submit.637244Third Party Advisory, VDB Entry
https://github.com/o2oa/o2oa/issues/182Exploit, Issue Tracking
https://github.com/o2oa/o2oa/issues/182#issue-3332970310Exploit, Issue Tracking
https://github.com/o2oa/o2oa/issues/182#issuecomment-3212879158Exploit, Issue Tracking

Timeline

Published: Aug 31, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-97175.4A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_asse CVE-2025-97185.4A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/ja CVE-2025-97195.4A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_desig CVE-2025-97205.4A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edi CVE-2025-97215.4A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. CVE-2025-97225.4A vulnerability has been found in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_t CVE-2025-97235.4A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.p CVE-2025-97245.4A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino CVE-2025-97258.8A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the com CVE-2025-97269.8A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2025-97279.8A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgi_main of the file /soap.cgi. This ma CVE-2025-97286.1A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Su