CVE-2025-13209CWE-610CWE-611xxe

CVE-2025-13209

Medium · published November 16, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity reference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Weaknesses
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere; CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-11-16T00:15Z
References (4)
https://github.com/bkglfpp/CVE-md/blob/main/%E4%BA%91%E7%BD%91%E5%8D%8F%E5%90%8C%E5%8A%9E%E5%85%AC%E7%B3%BB%E7%BB%9F/XXE.md · [email protected]https://vuldb.com/?ctiid.332528 · [email protected]https://vuldb.com/?id.332528 · [email protected]https://vuldb.com/?submit.685626 · [email protected]
EPSS history
Timeline
  • 15 NOV 18:32Z
    bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference
    cvelistv5