CVE-2025-10816CWE-610CWE-611xxe

CVE-2025-10816

High · published September 23, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weaknesses
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere; CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-09-23T02:15Z
Affected products (1)
ProductVersionsFixed in
jinher/jinher_oaall versions—
References (4)
https://github.com/1296299554/CVE/issues/1 · [email protected]https://vuldb.com/?ctiid.325174 · [email protected]https://vuldb.com/?id.325174 · [email protected]https://vuldb.com/?submit.654466 · [email protected]
EPSS history
Timeline
  • 22 SEP 21:32Z
    Jinher OA XML text xml external entity reference
    cvelistv5