CVE-2025-11341CWE-610CWE-611xxe

CVE-2025-11341

High · published October 6, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weaknesses
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere; CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-10-06T21:16Z
Affected products (1)
ProductVersionsFixed in
jinher/jinher_oa≤ 2.0—
References (4)
https://github.com/rookie1006/CVE/issues/2 · [email protected]https://vuldb.com/?ctiid.327226 · [email protected]https://vuldb.com/?id.327226 · [email protected]https://vuldb.com/?submit.664613 · [email protected]
EPSS history
Timeline
  • 06 OCT 17:02Z
    Jinher OA type xml external entity reference
    cvelistv5