CVE-2025-9646

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the Cipher Connection Handler component. Manipulation of the fileUrl argument leads to information disclosure. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.

O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.

Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.

A vulnerability was detected in O2OA up to 10.0-410 in an unknown function of the /x_query_assemble_designer/jaxrs/importmodel file within the Personal Profile Page component. Manipulation of the description/applicationName/queryName arguments results in cross site scripting, and the attack can be carried out remotely. The exploit is public and the vendor stated it will be fixed in a new version.

A cross-site scripting (XSS) vulnerability was detected in O2OA up to version 10.0-410. It affects an unknown function in the file /x_query_assemble_designer/jaxrs/statement of the Personal Profile Page component and is triggered by manipulating the description/queryName argument. The attack can be launched remotely and the exploit has been publicly disclosed.

A weakness has been identified in O2OA up to 10.0-410 affecting an unknown function of the file /x_query_assemble_designer/jaxrs/table within the Personal Profile Page component. Manipulation of the description/applicationName/queryName arguments causes cross site scripting, and the attack may be initiated remotely. The exploit has been made available to the public and could be exploited; the vendor stated it will be fixed in a new version.

A cross-site scripting (XSS) security flaw was discovered in O2OA up to version 10.0-410. It affects an unknown function in the file /x_query_assemble_designer/jaxrs/stat of the Personal Profile Page component, where manipulation of the name/alias/description/applicationName arguments leads to script execution. The attack can be launched remotely and the exploit has been released publicly.