CVE-2025-9735: O2OA Personal Profile table cross site scripting
A weakness has been identified in O2OA up to 10.0-410. This affects an unknown function of the file /xqueryassembledesigner/jaxrs/table of the component Personal Profile Page. This manipulation of the argument description/applicationName/queryName causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9735?
CVE-2025-9735 is categorized as a cross site scripting vulnerability, which can lead to sensitive data exposure.
How do I fix CVE-2025-9735?
To fix CVE-2025-9735, update O2OA to version 10.0-411 or later, ensuring all input is properly sanitized.
Which versions of O2OA are affected by CVE-2025-9735?
CVE-2025-9735 affects O2OA versions up to and including 10.0-410.
What component is vulnerable in CVE-2025-9735?
The vulnerability in CVE-2025-9735 affects the Personal Profile Page component of the O2OA application.
What type of attack does CVE-2025-9735 enable?
CVE-2025-9735 allows attackers to execute cross site scripting attacks through improper handling of user-supplied input.