CVE-2025-9659: O2OA Personal Profile widget cross site scripting
A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /xportalassembledesigner/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9659?
CVE-2025-9659 is classified as a medium severity vulnerability due to its potential for remote exploitation through cross-site scripting.
How do I fix CVE-2025-9659?
To fix CVE-2025-9659, update your O2OA software to the latest version that is greater than 10.0-410.
What component is affected by CVE-2025-9659?
CVE-2025-9659 affects the Personal Profile Page component in the O2OA software.
Can CVE-2025-9659 be exploited remotely?
Yes, CVE-2025-9659 can be exploited remotely, allowing attackers to execute cross-site scripting attacks.
What does cross-site scripting mean in the context of CVE-2025-9659?
In the context of CVE-2025-9659, cross-site scripting allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data.