A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/o2oa/o2oa/issues/172 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.1 · zonelandNVD modified 2026-10-19 17:10
Affected (CPE criteria) 1
cpe:2.3:a:zoneland:o2oa:*:*:*:*:*:*:*:*
References 5
- https://github.com/o2oa/o2oa/issues/172 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108 Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.321863 Permissions Required, VDB Entry
- https://vuldb.com/?id.321863 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.637131 Third Party Advisory, VDB Entry