Low severity3.5NVD Advisory· Published Aug 30, 2025· Updated Apr 29, 2026

CVE-2025-9681

Description

A flaw has been found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_program_center/jaxrs/agent of the component Personal Profile Page. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zoneland/O2oa
cpe:2.3:a:zoneland:o2oa:*:*:*:*:*:*:*:*
Range: <=10.0-410
O2oa/O2oallm-fuzzy
Range: <=10.0-410

Patches

Vulnerability mechanics

References

github.com/o2oa/o2oa/issues/177nvdExploitIssue TrackingVendor Advisory
github.com/o2oa/o2oa/issues/177nvdExploitIssue TrackingVendor Advisory
github.com/o2oa/o2oa/issues/178nvdExploitIssue TrackingVendor Advisory
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdPermissions RequiredVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000