CVE-2025-9734: O2OA Personal Profile stat cross site scripting
A security flaw has been discovered in O2OA up to 10.0-410. The impacted element is an unknown function of the file /xqueryassembledesigner/jaxrs/stat of the component Personal Profile Page. The manipulation of the argument name/alias/description/applicationName results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9734?
CVE-2025-9734 is classified as a critical vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-9734?
To mitigate CVE-2025-9734, it is recommended to update the O2OA Personal Profile Page to version 10.0-411 or later.
What are the affected components in CVE-2025-9734?
The affected component in CVE-2025-9734 is the Personal Profile Page of O2OA up to version 10.0-410.
What type of vulnerability is CVE-2025-9734?
CVE-2025-9734 is a cross-site scripting vulnerability caused by improper handling of parameters in the Personal Profile Page.
Who is impacted by CVE-2025-9734?
Organizations using O2OA Personal Profile Page versions up to 10.0-410 are impacted by CVE-2025-9734.