CVE-2025-10816: medium-severity vulnerability in Jinher OA
Jinher OA XML text xml external entity reference
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.6%
A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Jinher · OARelated CVEs — Jinher OA
In the same product, most dangerous first.
CVE-2025-10090MEDIUMJinher OA GetTreeDate.aspx sql injectionEPSS 1.9%CVE-2025-7523MEDIUMJinher OA DelTemp.aspx xml external entity referenceEPSS 0.7%CVE-2025-7824MEDIUMJinher OA XmlHttp.aspx xml external entity referenceEPSS 0.6%CVE-2025-7823MEDIUMJinher OA ProjectScheduleDelete.aspx xml external entity referenceEPSS 0.6%CVE-2025-10092MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.6%CVE-2025-10091MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.6%