O2OA Dok 10.0-410 Personal Profile Page process name/alias Skriptovanje preko sajta

Pronađena je ranjivost klasifikovana kao Problematiиno u O2OA Dok 10.0-410. Zahvaćeno je nepoznata funkcija u fajlu /x_processplatform_assemble_designer/jaxrs/process u komponenti Personal Profile Page. Izmena argumenta name/alias rezultira Skriptovanje preko sajta. Definisanje problema putem CWE vodi do CWE-79. Ova slabost je objavljena 08/30/2025 kao 184. Obaveštenje možete preuzeti sa github.com. Ova ranjivost je registrovana kao CVE-2025-9718. Napad se može izvesti na daljinu. Napad je moguć samo unutar lokalne mreže. Postoje tehnički detalji. Поред тога, експлоит је доступан. Eksploit je postao dostupan javnosti i može biti upotrebljen. Trenutno je cena za eksploataciju približno USD $0-$5k u ovom momentu. Projekat MITRE ATT&CK označava tehniku napada kao T1059.007. Klasifikovano je kao dokaz-of-koncept. Ekspoit se može preuzeti sa github.com. Kao 0-day, procenjuje se da je cena na ilegalnom tržištu bila oko $0-$5k. Once again VulDB remains the best source for vulnerability data.

4 Promene · 100 Tačke podataka

PoljeKreirali
08/30/2025 13:10		Ažurira 1/3
08/31/2025 09:47		Ažurira 2/3
08/31/2025 10:46		Ažurira 3/3
09/10/2025 01:50
software_nameO2OAO2OAO2OAO2OA
software_version<=10.0-410<=10.0-410<=10.0-410<=10.0-410
software_componentPersonal Profile PagePersonal Profile PagePersonal Profile PagePersonal Profile Page
software_file/x_processplatform_assemble_designer/jaxrs/process/x_processplatform_assemble_designer/jaxrs/process/x_processplatform_assemble_designer/jaxrs/process/x_processplatform_assemble_designer/jaxrs/process
software_argumentname/aliasname/aliasname/aliasname/alias
vulnerability_cweCWE-79 (Skriptovanje preko sajta)CWE-79 (Skriptovanje preko sajta)CWE-79 (Skriptovanje preko sajta)CWE-79 (Skriptovanje preko sajta)
vulnerability_risk1111
cvss3_vuldb_avNNNN
cvss3_vuldb_acLLLL
cvss3_vuldb_prLLLL
cvss3_vuldb_uiRRRR
cvss3_vuldb_sUUUU
cvss3_vuldb_cNNNN
cvss3_vuldb_iLLLL
cvss3_vuldb_aNNNN
cvss3_vuldb_ePPPP
cvss3_vuldb_rcCCCC
advisory_identifier184184184184
advisory_urlhttps://github.com/o2oa/o2oa/issues/184https://github.com/o2oa/o2oa/issues/184https://github.com/o2oa/o2oa/issues/184https://github.com/o2oa/o2oa/issues/184
advisory_confirm_urlhttps://github.com/o2oa/o2oa/issues/184#issuecomment-3212876305https://github.com/o2oa/o2oa/issues/184#issuecomment-3212876305https://github.com/o2oa/o2oa/issues/184#issuecomment-3212876305https://github.com/o2oa/o2oa/issues/184#issuecomment-3212876305
exploit_availability1111
exploit_publicity1111
exploit_urlhttps://github.com/o2oa/o2oa/issues/184#issue-3332975833https://github.com/o2oa/o2oa/issues/184#issue-3332975833https://github.com/o2oa/o2oa/issues/184#issue-3332975833https://github.com/o2oa/o2oa/issues/184#issue-3332975833
source_cveCVE-2025-9718CVE-2025-9718CVE-2025-9718CVE-2025-9718
cna_responsibleVulDBVulDBVulDBVulDB
response_summaryThe vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
cvss2_vuldb_avNNNN
cvss2_vuldb_acLLLL
cvss2_vuldb_ciNNNN
cvss2_vuldb_iiPPPP
cvss2_vuldb_aiNNNN
cvss2_vuldb_ePOCPOCPOCPOC
cvss2_vuldb_rcCCCC
cvss4_vuldb_avNNNN
cvss4_vuldb_acLLLL
cvss4_vuldb_prLLLL
cvss4_vuldb_uiPPPP
cvss4_vuldb_vcNNNN
cvss4_vuldb_viLLLL
cvss4_vuldb_vaNNNN
cvss4_vuldb_ePPPP
cvss2_vuldb_auSSSS
cvss2_vuldb_rlNDNDNDND
cvss3_vuldb_rlXXXX
cvss4_vuldb_atNNNN
cvss4_vuldb_scNNNN
cvss4_vuldb_siNNNN
cvss4_vuldb_saNNNN
cvss2_vuldb_basescore4.04.04.04.0
cvss2_vuldb_tempscore3.63.63.63.6
cvss3_vuldb_basescore3.53.53.53.5
cvss3_vuldb_tempscore3.33.33.33.3
cvss3_meta_basescore3.53.53.54.1
cvss3_meta_tempscore3.33.33.44.1
cvss4_vuldb_bscore5.15.15.15.1
cvss4_vuldb_btscore2.02.02.02.0
advisory_date1756504800 (08/30/2025)1756504800 (08/30/2025)1756504800 (08/30/2025)1756504800 (08/30/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k
euvd_idEUVD-2025-26286EUVD-2025-26286EUVD-2025-26286
cvss4_cna_uiPP
cvss4_cna_vcNN
cvss4_cna_viLL
cvss4_cna_vaNN
cvss4_cna_scNN
cvss4_cna_siNN
cvss4_cna_saNN
cvss4_cna_bscore5.15.1
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prLL
cvss3_cna_uiRR
cvss3_cna_sUU
cvss3_cna_cNN
cvss3_cna_iLL
cvss3_cna_aNN
cvss3_cna_basescore3.53.5
cvss2_cna_avNN
cvss2_cna_acLL
cvss2_cna_auSS
cvss2_cna_ciNN
cvss2_cna_iiPP
cvss2_cna_aiNN
cvss2_cna_basescore44
cve_nvd_summaryA security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
cvss4_cna_avNN
cvss4_cna_acLL
cvss4_cna_atNN
cvss4_cna_prLL
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiR
cvss3_nvd_sC
cvss3_nvd_cL
cvss3_nvd_iL
cvss3_nvd_aN
cvss3_nvd_basescore5.4

◂ PrethodnePregledSledeжi ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!