CVE-2025-10816
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jinher | jinher_oa | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
| CWE-610 | The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a security flaw in Jinher OA 2.0 affecting the XML Handler component, specifically in the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add. It allows an attacker to perform XML External Entity (XXE) injection by manipulating the component, which can be exploited remotely. The exploit has been publicly released.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive data, denial of service, or other impacts due to XML External Entity injection. Since it can be exploited remotely without authentication, it poses a significant security risk to affected systems.