211 matches found
CVE-2025-9657
CVE-2025-9657 (O2OA) affects O2OA up to version 10.0-410, specifically the Personal Profile Page component. The vulnerability is a cross-site scripting flaw caused by improper processing of the file path /x_program_center/jaxrs/script where manipulation of the argument name/alias/description can ...
CVE-2025-9655 O2OA Personal Profile person cross site scripting
A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...
CVE-2025-9655 O2OA Personal Profile person cross site scripting
A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...
CVE-2025-9655
A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...
CVE-2025-9655
CVE-2025-9655 affects O2OA up to version 10.0-410, specifically the Personal Profile Page component. The issue arises from manipulating the Description argument in the /x_organization_assemble_control/jaxrs/person/ file, enabling cross-site scripting. Exploitation can be performed remotely. Vendo...
CVE-2025-9646
A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /xorganizationassemblepersonal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. Th...
O2OA 安全漏洞
O2OA is an enterprise application development platform from O2OA Open Source. A security vulnerability exists in O2OA 10.0-410 and earlier versions, which originates from cross-site scripting due to incorrect operation of the parameter toMonthViewName in the file...
O2OA 安全漏洞
O2OA is an enterprise application development platform from O2OA open source. A security vulnerability exists in O2OA 10.0-410 and earlier versions, which originates from a cross-site scripting due to the incorrect operation of the parameter name/alias/description in the file...
CVE-2025-9659: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /xportalassembledesigner/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been...
CVE-2025-9658: Improper Neutralization of Input During Web Page Generation
A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /xportalassembledesigner/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possibl...
CVE-2025-9646: Improper Neutralization of Input During Web Page Generation
A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /xorganizationassemblepersonal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. Th...
CVE-2025-9655: Improper Neutralization of Input During Web Page Generation
A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /xorganizationassemblecontrol/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched...
PT-2025-35226
Name of the Vulnerable Software and Affected Versions: O2OA versions up to 10.0-410 Description: A weakness exists in O2OA up to version 10.0-410, specifically within the Personal Profile Page component. Manipulation of the Description argument in the /x organization assemble control/jaxrs/person...
CVE-2025-9657: Improper Neutralization of Input During Web Page Generation
A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /xprogramcenter/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched...
CVE-2024-37777
The enterprise application development platform O2OA version 9.0.3 is vulnerable to remote code execution (RCE) . The flaw originates from the mishandling of the mainOutput() function , which is associated with improper input validation (CWE-20) and improper control of generation of code (CWE-94)...
CVE-2024-37777
O2OA v9.0.3 was discovered to contain a remote code execution RCE vulnerability via the mainOutput function...
PT-2025-34929
Name of the Vulnerable Software and Affected Versions: O2OA version 9.0.3 Description: O2OA version 9.0.3 contains a remote code execution RCE issue via the mainOutput function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerabilit...
O2OA 安全漏洞
O2OA is an enterprise application development platform from O2OA open source. A security vulnerability exists in O2OA version 9.0.3, which stems from mishandling of the mainOutput function and could lead to remote code execution...