CVE-2025-11035mediumCWE-610CWE-611

CVE-2025-11035: falha de média gravidade em Jinher OA

Jinher OA text xml external entity reference

Publicada em

Seguir esta CVE+ Monitorar OA

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Jinher · OA
CVEs relacionadas — Jinher OA

No mesmo produto, das mais perigosas para as menos.

CVE-2025-10090MEDIUMJinher OA GetTreeDate.aspx sql injectionEPSS 1.9%CVE-2025-7523MEDIUMJinher OA DelTemp.aspx xml external entity referenceEPSS 0.7%CVE-2025-10092MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.6%CVE-2025-10091MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.6%CVE-2025-7824MEDIUMJinher OA XmlHttp.aspx xml external entity referenceEPSS 0.6%CVE-2025-7823MEDIUMJinher OA ProjectScheduleDelete.aspx xml external entity referenceEPSS 0.6%