Zoneland O2Oa vulnerabilities

CVE-2025-9717 [MEDIUM] CWE-79 CVE-2025-9717: A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functi A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_assemble_control/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelName leads to cross site scripting. The attack may be la

CVE-2025-9658 [MEDIUM] CWE-79 CVE-2025-9658: A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_ A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The

CVE-2025-9655 [MEDIUM] CWE-79 CVE-2025-9655: A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_o A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor replied in the GitHub issue (translate

CVE-2025-22994 [MEDIUM] CWE-79 CVE-2025-22994: O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings. O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.