https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2074.htmlhttps://patchthecve.com/cve/CVE-2026-2074.htmlWed, 17 Jun 2026 10:30:15 +0000MEDIUM 6.3: A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit is https://patchthecve.com/cve/CVE-2025-9737.htmlhttps://patchthecve.com/cve/CVE-2025-9737.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /x_query_assemble_designer/jaxrs/importmodel of the component Personal Profile Page. Performing manipulation of the argument description/applicationName/queryName results in cross site scripting. Remote https://patchthecve.com/cve/CVE-2025-9736.htmlhttps://patchthecve.com/cve/CVE-2025-9736.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A security vulnerability has been detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_query_assemble_designer/jaxrs/statement of the component Personal Profile Page. Such manipulation of the argument description/queryName leads to cross site scripting. The attack may be https://patchthecve.com/cve/CVE-2025-9735.htmlhttps://patchthecve.com/cve/CVE-2025-9735.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A weakness has been identified in O2OA up to 10.0-410. This affects an unknown function of the file /x_query_assemble_designer/jaxrs/table of the component Personal Profile Page. This manipulation of the argument description/applicationName/queryName causes cross site scripting. The attack may be inhttps://patchthecve.com/cve/CVE-2025-9734.htmlhttps://patchthecve.com/cve/CVE-2025-9734.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A security flaw has been discovered in O2OA up to 10.0-410. The impacted element is an unknown function of the file /x_query_assemble_designer/jaxrs/stat of the component Personal Profile Page. The manipulation of the argument name/alias/description/applicationName results in cross site scripting. Thttps://patchthecve.com/cve/CVE-2025-9719.htmlhttps://patchthecve.com/cve/CVE-2025-9719.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_designer/jaxrs/script of the component Personal Profile Page. Executing manipulation of the argument name/alias/description/applicationName can lead to cross site schttps://patchthecve.com/cve/CVE-2025-9718.htmlhttps://patchthecve.com/cve/CVE-2025-9718.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of thttps://patchthecve.com/cve/CVE-2025-9717.htmlhttps://patchthecve.com/cve/CVE-2025-9717.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_assemble_control/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelNahttps://patchthecve.com/cve/CVE-2025-9716.htmlhttps://patchthecve.com/cve/CVE-2025-9716.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. https://patchthecve.com/cve/CVE-2025-9715.htmlhttps://patchthecve.com/cve/CVE-2025-9715.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_cms_assemble_control/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack can be launched remotely. Thehttps://patchthecve.com/cve/CVE-2025-9683.htmlhttps://patchthecve.com/cve/CVE-2025-9683.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_cms_assemble_control/jaxrs/form of the component Personal Profile Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit has been mahttps://patchthecve.com/cve/CVE-2025-9682.htmlhttps://patchthecve.com/cve/CVE-2025-9682.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_cms_assemble_control/jaxrs/design/appdict of the component Personal Profile Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. Thehttps://patchthecve.com/cve/CVE-2025-9681.htmlhttps://patchthecve.com/cve/CVE-2025-9681.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A flaw has been found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_program_center/jaxrs/agent of the component Personal Profile Page. Executing manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be usedhttps://patchthecve.com/cve/CVE-2025-9680.htmlhttps://patchthecve.com/cve/CVE-2025-9680.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_portal_assemble_designer/jaxrs/page of the component Personal Profile Page. Performing manipulation results in cross site scripting. The attack can be initiated remotely. The exploit is now public anhttps://patchthecve.com/cve/CVE-2025-9659.htmlhttps://patchthecve.com/cve/CVE-2025-9659.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been dhttps://patchthecve.com/cve/CVE-2025-9658.htmlhttps://patchthecve.com/cve/CVE-2025-9658.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possiblhttps://patchthecve.com/cve/CVE-2025-9657.htmlhttps://patchthecve.com/cve/CVE-2025-9657.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched remothttps://patchthecve.com/cve/CVE-2025-9655.htmlhttps://patchthecve.com/cve/CVE-2025-9655.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remothttps://patchthecve.com/cve/CVE-2025-9646.htmlhttps://patchthecve.com/cve/CVE-2025-9646.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.5: A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. Thhttps://patchthecve.com/cve/CVE-2024-37777.htmlhttps://patchthecve.com/cve/CVE-2024-37777.htmlWed, 17 Jun 2026 07:38:50 +0000HIGH 8.8: O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.https://patchthecve.com/cve/CVE-2025-22994.htmlhttps://patchthecve.com/cve/CVE-2025-22994.htmlWed, 17 Jun 2026 08:51:20 +0000MEDIUM 6.1: O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.https://patchthecve.com/cve/CVE-2024-35591.htmlhttps://patchthecve.com/cve/CVE-2024-35591.htmlWed, 17 Jun 2026 07:35:04 +0000MEDIUM 5.4: An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.https://patchthecve.com/cve/CVE-2024-3689.htmlhttps://patchthecve.com/cve/CVE-2024-3689.htmlWed, 17 Jun 2026 07:44:49 +0000LOW 3.7: A vulnerability classified as problematic has been found in Zhejiang Land Zongheng Network Technology O2OA up to 20240403. Affected is an unknown function of the file /x_portal_assemble_surface/jaxrs/portal/list?v=8.2.3-4-43f4fe3. The manipulation leads to information disclosure. It is possible to l