Vulnerabilities

TI-2026-01729 CVE-2026-2074 · GHSA-wxpc-f9fq-w9pq

O2OA HTTP POST Request check xml external entity reference

MEDIUM 57

A vulnerability was identified in O2OA up to 9.0.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00316 Published 2026-02-07 No fix listed CWE-610

TI-2025-08927 CVE-2025-9737 · GHSA-hggh-mrgq-wcfh

O2OA Personal Profile importmodel cross site scripting

MEDIUM 56

A vulnerability was detected in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00349 Published 2025-08-31 No fix listed CWE-79

TI-2025-08926 CVE-2025-9736 · GHSA-7qf4-c7px-mm2r

O2OA Personal Profile statement cross site scripting

MEDIUM 56

A security vulnerability has been detected in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00349 Published 2025-08-31 No fix listed CWE-79

TI-2025-08925 CVE-2025-9735 · GHSA-8c24-3q9p-rgj3

O2OA Personal Profile table cross site scripting

MEDIUM 56

A weakness has been identified in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00282 Published 2025-08-31 No fix listed CWE-79

TI-2025-08924 CVE-2025-9734 · GHSA-pxmj-3jq4-mpmc

O2OA Personal Profile stat cross site scripting

MEDIUM 56

A security flaw has been discovered in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00349 Published 2025-08-31 No fix listed CWE-79

TI-2025-08909 CVE-2025-9719 · GHSA-mcmm-333p-x7jv

O2OA Personal Profile script cross site scripting

MEDIUM 56

A weakness has been identified in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00275 Published 2025-08-31 No fix listed CWE-79

TI-2025-08908 CVE-2025-9718 · GHSA-982p-xx32-2jcp

O2OA Personal Profile process cross site scripting

MEDIUM 56

A security flaw has been discovered in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00348 Published 2025-08-31 No fix listed CWE-79

TI-2025-08907 CVE-2025-9717 · GHSA-gm96-82gj-wrpp

O2OA Personal Profile unit cross site scripting

MEDIUM 56

A vulnerability was identified in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00275 Published 2025-08-31 No fix listed CWE-79

TI-2025-08906 CVE-2025-9716 · GHSA-ch38-rrf9-v6gp

O2OA Personal Profile form cross site scripting

MEDIUM 56

A vulnerability was determined in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00322 Published 2025-08-31 No fix listed CWE-79

TI-2025-08905 CVE-2025-9715 · GHSA-65r3-5cr9-gh49

O2OA Personal Profile script cross site scripting

MEDIUM 56

A vulnerability was found in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00341 Published 2025-08-31 No fix listed CWE-79

TI-2025-08874 CVE-2025-9683 · GHSA-q8pv-pjmh-2j76

O2OA Personal Profile form cross site scripting

MEDIUM 56

A vulnerability was found in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00341 Published 2025-08-30 No fix listed CWE-79

TI-2025-08873 CVE-2025-9682 · GHSA-cm4w-gfpw-w26h

O2OA Personal Profile appdict cross site scripting

MEDIUM 56

A vulnerability has been found in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00341 Published 2025-08-30 No fix listed CWE-79

TI-2025-08872 CVE-2025-9681 · GHSA-x2ph-wc3j-j76g

O2OA Personal Profile agent cross site scripting

MEDIUM 56

A flaw has been found in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00344 Published 2025-08-30 No fix listed CWE-79

TI-2025-08871 CVE-2025-9680 · GHSA-f4w6-8h65-9qw5

O2OA Personal Profile page cross site scripting

MEDIUM 56

A vulnerability was detected in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00429 Published 2025-08-30 No fix listed CWE-79

TI-2025-08851 CVE-2025-9659 · GHSA-pr56-977p-63w3

O2OA Personal Profile widget cross site scripting

MEDIUM 56

A vulnerability has been found in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00284 Published 2025-08-29 No fix listed CWE-79

TI-2025-08850 CVE-2025-9658 · GHSA-fvc4-g78m-7vjx

O2OA Personal Profile dict cross site scripting

MEDIUM 56

A flaw has been found in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00284 Published 2025-08-29 No fix listed CWE-79

TI-2025-08849 CVE-2025-9657 · GHSA-7362-2xmg-pxmf

O2OA Personal Profile script cross site scripting

MEDIUM 56

A vulnerability was detected in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00284 Published 2025-08-29 No fix listed CWE-79

TI-2025-08847 CVE-2025-9655 · GHSA-mv3p-p7j7-cc35

O2OA Personal Profile person cross site scripting

MEDIUM 56

A weakness has been identified in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00275 Published 2025-08-29 No fix listed CWE-79

TI-2025-08838 CVE-2025-9646 · GHSA-hj93-8xvj-w9rj

O2OA calendarConfig cross site scripting

MEDIUM 56

A security flaw has been discovered in O2OA up to 10.0-410.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00284 Published 2025-08-29 No fix listed CWE-79

TI-2024-25148 CVE-2024-37777 · GHSA-qf35-whhw-ph4r

O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.

HIGH 73

O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00516 Published 2025-08-27 No fix listed CWE-20

TI-2025-16815 CVE-2025-22994 · GHSA-8g8x-p6f2-rwgm

O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.

MEDIUM 60

O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0029 Published 2025-01-31 No fix listed CWE-79

TI-2024-23490 CVE-2024-35591

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute…

MEDIUM 58

An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00435 Published 2024-05-24 No fix listed CWE-79

TI-2024-03442 CVE-2024-3689 · GHSA-qh44-8fg4-8px7

Zhejiang Land Zongheng Network Technology O2OA information disclosure

MEDIUM 60

A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00886 Published 2024-04-12 No fix listed CWE-200

TI-2023-25644 CVE-2023-47418 · GHSA-29fh-m28h-hr9q

Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows…

MEDIUM 45

Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to execute JavaScript.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01527 Published 2023-11-30 No fix listed

TI-2022-07106 CVE-2022-22916 · GHSA-xh25-p8f3-4864

O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.

HIGH 69

O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.38651 Published 2022-02-17 No fix listed

Vulnerabilities

Filters