CVE-2025-10091CWE-610CWE-611xxe

CVE-2025-10091

High · published September 8, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00568 · 46.3th percentile
Weaknesses
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere; CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-09-08T15:15Z
Affected products (1)
ProductVersionsFixed in
jinher/jinher_oa≤ 1.2—
References (4)
https://github.com/Cstarplus/CVE/issues/2 · [email protected]https://vuldb.com/?ctiid.323046 · [email protected]https://vuldb.com/?id.323046 · [email protected]https://vuldb.com/?submit.644864 · [email protected]
EPSS history
Timeline
  • 08 SEP 11:02Z
    Jinher OA XML Type xml external entity reference
    cvelistv5