CVE-2024-37777

The enterprise application development platform O2OA version 9.0.3 is vulnerable to remote code execution (RCE) . The flaw originates from the mishandling of the mainOutput() function , which is associated with improper input validation (CWE-20) and improper control of generation of code (CWE-94)...

CVE-2024-37777

O2OA v9.0.3 was discovered to contain a remote code execution RCE vulnerability via the mainOutput function...

CVE-2025-22994

O2OA 9.1.3 is vulnerable to Cross Site Scripting XSS in Meetings - Settings...

CVE-2023-47418

Remote Code Execution RCE vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to execute JavaScript...

CVE-2022-22916

O2OA v6.4.7 was discovered to contain a remote code execution RCE vulnerability via /xprogramcenter/jaxrs/invoke...

CVE-2024-35591

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2025-22994

O2OA 9.1.3 is vulnerable to Cross Site Scripting XSS in Meetings - Settings...

CVE-2025-22994: Improper Neutralization of Input During Web Page Generation

O2OA 9.1.3 is vulnerable to Cross Site Scripting XSS in Meetings - Settings...

CVE-2025-22994

O2OA version 9.1.3 is vulnerable to Cross-Site Scripting (XSS) within the Meetings - Settings section. This flaw allows for the potential execution of malicious scripts by an attacker. To remediate this issue, users should update to a version that includes a patch for this vulnerability or consid...

CVE-2025-22994

O2OA 9.1.3 is vulnerable to Cross Site Scripting XSS in Meetings - Settings...

PT-2025-4759 · O2Oa · O2Oa

Name of the Vulnerable Software and Affected Versions: O2OA version 9.1.3 Description: The issue is related to Cross Site Scripting XSS in the Meetings - Settings section. This allows for potential malicious script execution. Recommendations: For O2OA version 9.1.3, update to a version that...

CVE-2025-22994

O2OA 9.1.3 is vulnerable to Cross Site Scripting XSS in Meetings - Settings...

CVE-2024-35591

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-35591

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-35591

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-35591

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-35591

O2OA v8.3.8 is affected by an arbitrary file upload vulnerability that enables attackers to achieve arbitrary code execution by uploading a specially crafted PDF file. The root cause involves the improper neutralization of input during web page generation. While no direct exploit links are provid...

PT-2024-26563

Name of the Vulnerable Software and Affected Versions O2OA version 8.3.8 Description The issue allows attackers to execute arbitrary code by uploading a crafted PDF file, exploiting an arbitrary file upload vulnerability. Recommendations For O2OA version 8.3.8, consider restricting file uploads t...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA open source. A security vulnerability exists in O2OA v8.3.8, which stems from the presence of an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code by uploading a crafted PDF file...

CVE-2024-35591: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...