A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/o2oa/o2oa/issues/175 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/o2oa/o2oa/issues/175#issue-3332931249 Exploit, Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 2.0 · zonelandNVD modified 2026-10-19 17:10
Affected (CPE criteria) 1
cpe:2.3:a:zoneland:o2oa:*:*:*:*:*:*:*:*
References 6
- https://github.com/o2oa/o2oa/issues/175 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/o2oa/o2oa/issues/175#issue-3332931249 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/o2oa/o2oa/issues/175#issuecomment-3212881171 Issue Tracking
- https://vuldb.com/?ctiid.321867 Permissions Required, VDB Entry
- https://vuldb.com/?id.321867 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.637235 Third Party Advisory, VDB Entry