CVE-2025-10091: falha de média gravidade em Jinher OA
Jinher OA XML Type xml external entity reference
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.6%
A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Jinher · OACVEs relacionadas — Jinher OA
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10090MEDIUMJinher OA GetTreeDate.aspx sql injectionEPSS 1.9%CVE-2025-7523MEDIUMJinher OA DelTemp.aspx xml external entity referenceEPSS 0.7%CVE-2025-10092MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.6%CVE-2025-7824MEDIUMJinher OA XmlHttp.aspx xml external entity referenceEPSS 0.6%CVE-2025-7823MEDIUMJinher OA ProjectScheduleDelete.aspx xml external entity referenceEPSS 0.6%CVE-2025-10816MEDIUMJinher OA XML text xml external entity referenceEPSS 0.6%