What’s Vulnerable › Products
O2OA vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.
Check whether your O2OA version is affected
Latest O2OA vulnerabilities
- CVE-2026-105438 — O2OA General url ActionUploadExcelWithUrl server-side request forgery (CVSS 4.3)
- CVE-2026-97179 — O2OA Cipher Connection CipherConnectionAction.java list information disclosure (CVSS 4.3)
- CVE-2026-7292 — o2oa NodeAgent NodeAgent.java syncFile improper authorization (CVSS 5.6)
- CVE-2026-7291 — o2oa URL Fetching FileAction.java FileAction server-side request forgery (CVSS 6.3)
- CVE-2026-2074 — O2OA HTTP POST Request check xml external entity reference (CVSS 6.3)
- CVE-2025-9737 — O2OA Personal Profile importmodel cross site scripting (CVSS 5.4)
- CVE-2025-9736 — O2OA Personal Profile statement cross site scripting (CVSS 5.4)
- CVE-2025-9735 — O2OA Personal Profile table cross site scripting (CVSS 5.4)
- CVE-2025-9734 — O2OA Personal Profile stat cross site scripting (CVSS 5.4)
- CVE-2025-9719 — O2OA Personal Profile script cross site scripting (CVSS 5.4)
- CVE-2025-9718 — O2OA Personal Profile process cross site scripting (CVSS 5.4)
- CVE-2025-9717 — O2OA Personal Profile unit cross site scripting (CVSS 5.4)
- CVE-2025-9716 — O2OA Personal Profile form cross site scripting (CVSS 5.4)
- CVE-2025-9715 — O2OA Personal Profile script cross site scripting (CVSS 5.4)
- CVE-2025-9683 — O2OA Personal Profile form cross site scripting (CVSS 5.4)
- CVE-2025-9682 — O2OA Personal Profile appdict cross site scripting (CVSS 5.4)
- CVE-2025-9681 — O2OA Personal Profile agent cross site scripting (CVSS 5.4)
- CVE-2025-9680 — O2OA Personal Profile page cross site scripting (CVSS 5.4)
- CVE-2025-9659 — O2OA Personal Profile widget cross site scripting (CVSS 5.4)
- CVE-2025-9658 — O2OA Personal Profile dict cross site scripting (CVSS 5.4)
- CVE-2025-9657 — O2OA Personal Profile script cross site scripting (CVSS 5.4)
- CVE-2025-9655 — O2OA Personal Profile person cross site scripting (CVSS 5.4)
- CVE-2025-9646 — O2OA calendarConfig cross site scripting (CVSS 5.4)
- CVE-2024-37777 — (CVSS 8.8)
- CVE-2025-22994 — (CVSS 6.1)