CVE-2025-9717

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_assemble_control/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelName leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	O2OA	10.0-410

References

https://github.com/o2oa/o2oa/issues/183Exploit, Issue Tracking, Vendor Advisory
https://github.com/o2oa/o2oa/issues/183#issue-3332973239Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.322005Permissions Required, VDB Entry
https://vuldb.com/?id.322005Third Party Advisory, VDB Entry
https://vuldb.com/?submit.637245Third Party Advisory, VDB Entry
https://github.com/o2oa/o2oa/issues/183Exploit, Issue Tracking, Vendor Advisory
https://github.com/o2oa/o2oa/issues/183#issue-3332973239Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Aug 31, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-97185.4A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/ja CVE-2025-97195.4A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_desig CVE-2025-97205.4A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edi CVE-2025-97215.4A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. CVE-2025-97225.4A vulnerability has been found in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_t CVE-2025-97235.4A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.p CVE-2025-97245.4A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino CVE-2025-97258.8A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the com CVE-2025-97269.8A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2025-97279.8A weakness has been identified in D-Link DIR-816L 206b01. Affected by this issue is the function soapcgi_main of the file /soap.cgi. This ma CVE-2025-97286.1A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Su CVE-2025-97299.8A vulnerability was detected in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /admin/studen