CVE-2025-9657: O2OA Personal Profile script cross site scripting
A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /xprogramcenter/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9657?
CVE-2025-9657 is classified as a high severity vulnerability due to its potential for cross site scripting attacks.
How do I fix CVE-2025-9657?
To fix CVE-2025-9657, ensure that you update O2OA Personal Profile Page to a version later than 10.0-410 where the vulnerability is patched.
What systems are affected by CVE-2025-9657?
CVE-2025-9657 affects O2OA Personal Profile Page versions up to and including 10.0-410.
What type of vulnerability is CVE-2025-9657?
CVE-2025-9657 is a cross site scripting (XSS) vulnerability.
What are the potential impacts of CVE-2025-9657?
Exploitation of CVE-2025-9657 could lead to unauthorized data access or manipulation by executing arbitrary scripts in the user's browser.