CVE-2025-9681: O2OA Personal Profile agent cross site scripting
A flaw has been found in O2OA up to 10.0-410. Affected is an unknown function of the file /xprogramcenter/jaxrs/agent of the component Personal Profile Page. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9681?
CVE-2025-9681 is classified as a moderate severity vulnerability due to its potential impact on web application security.
How do I fix CVE-2025-9681?
To fix CVE-2025-9681, update the O2OA Personal Profile Page to the latest version beyond 10.0-410.
What kind of attack can exploit CVE-2025-9681?
CVE-2025-9681 can be exploited to perform cross-site scripting (XSS) attacks.
Is CVE-2025-9681 remotely exploitable?
Yes, CVE-2025-9681 can be exploited remotely, allowing attackers to execute attacks without physical access.
Which version of O2OA Personal Profile Page is affected by CVE-2025-9681?
O2OA Personal Profile Page versions up to and including 10.0-410 are affected by CVE-2025-9681.