CVE-2025-9680
BaseFortify
Publication date: 2025-08-30
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zoneland | o2oa | to 10.0-410 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9680 is a stored cross-site scripting (XSS) vulnerability in the O2OA application up to version 10.0-410. It occurs in the endpoint /x_portal_assemble_designer/jaxrs/page, where user inputs in personal profile fields (such as name, alias, description, and category) are not properly sanitized before being stored and later rendered. This allows attackers to inject malicious scripts that persist and execute in the browsers of users who view the affected pages. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to persistent execution of malicious JavaScript in users' browsers, potentially resulting in theft of session tokens, exposure of sensitive user data, and unauthorized actions performed on behalf of authenticated users. Attackers can remotely exploit this flaw by sending crafted requests, and the malicious scripts execute when victims view the compromised profile pages. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the vulnerable endpoint `/x_portal_assemble_designer/jaxrs/page` for stored cross-site scripting (XSS) by sending crafted POST requests containing typical XSS payloads in user profile fields such as "name," "alias," "description," and "category." For example, using curl to send a JSON payload with a script injection like `"><img src=1 onerror=alert(1)>` can help verify if the input is stored and executed. A sample command to test might be: curl -X POST https://target/o2oa/x_portal_assemble_designer/jaxrs/page -H "Content-Type: application/json" -d '{"name":""><img src=1 onerror=alert(1)>", "alias":"test", "description":"test", "category":"test"}' If the script executes when viewing the profile page, the vulnerability is present. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include filtering and escaping user inputs in the affected profile fields before storage and ensuring proper output encoding when rendering these fields in the application interface to prevent script execution. Since the vendor has acknowledged the issue and plans to fix it in a future version, users should consider restricting access to the vulnerable endpoint, applying input validation at the application or web server level, and monitoring for suspicious activity. If possible, temporarily disabling or limiting the use of the Personal Profile Page component until a patch is released is advisable. [2, 3]