Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

O2OA — Vulnerabilities & Security Advisories 25

All 25 CVE vulnerabilities found in O2OA, with AI-generated Chinese analysis, references, and POCs.

This page aggregates publicly disclosed security vulnerabilities affecting O2OA, the enterprise workflow and office automation platform developed by O2OA, specifically categorized under remote code execution, SQL injection, and unauthorized access weaknesses. The collection encompasses a comprehensive range of reported flaws identified between 2015 and the present, including critical buffer overflows, cross-site scripting issues, and privilege escalation vectors found in various software versions. Users can utilize this resource to track the vendor's official security advisories, analyze the broader implications of specific weakness classes within the O2OA ecosystem, or review the complete historical vulnerability record for the product to assess long-term security trends. The data presented here is derived from trusted public sources and security bulletins, offering a consolidated view of known risks without commercial endorsement or promotional language. By examining the chronological distribution of these findings, security professionals and system administrators can better prioritize patch management strategies and understand the evolution of threats targeting this specific software suite. This centralized repository serves as a factual reference for incident response teams and auditors requiring detailed insight into the security posture of O2OA installations across their organizations.

Vendor: Zhejiang Land Zongheng Network Technology

CVE ID Title CVSS Severity Published
CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint CWE-639 5.3 Medium 2026-10-16
CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery CWE-918 4.3 Medium 2026-10-05
CVE-2026-97179 O2OA Cipher Connection CipherConnectionAction.java list information disclosure CWE-200 4.3 Medium 2026-09-24
CVE-2026-7292 o2oa NodeAgent NodeAgent.java syncFile improper authorization CWE-285 5.6 Medium 2026-04-28
CVE-2026-7291 o2oa URL Fetching FileAction.java FileAction server-side request forgery CWE-918 6.3 Medium 2026-04-28
CVE-2026-2074 O2OA HTTP POST Request check xml external entity reference CWE-611 6.3 Medium 2026-02-07
CVE-2025-9737 O2OA Personal Profile importmodel cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9736 O2OA Personal Profile statement cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9735 O2OA Personal Profile table cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9734 O2OA Personal Profile stat cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9719 O2OA Personal Profile script cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9718 O2OA Personal Profile process cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9717 O2OA Personal Profile unit cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9716 O2OA Personal Profile form cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9715 O2OA Personal Profile script cross site scripting CWE-79 3.5 Low 2025-08-31
CVE-2025-9683 O2OA Personal Profile form cross site scripting CWE-79 3.5 Low 2025-08-30
CVE-2025-9682 O2OA Personal Profile appdict cross site scripting CWE-79 3.5 Low 2025-08-30
CVE-2025-9681 O2OA Personal Profile agent cross site scripting CWE-79 3.5 Low 2025-08-30
CVE-2025-9680 O2OA Personal Profile page cross site scripting CWE-79 3.5 Low 2025-08-30
CVE-2025-9659 O2OA Personal Profile widget cross site scripting CWE-79 3.5 Low 2025-08-29
CVE-2025-9658 O2OA Personal Profile dict cross site scripting CWE-79 3.5 Low 2025-08-29
CVE-2025-9657 O2OA Personal Profile script cross site scripting CWE-79 3.5 Low 2025-08-29
CVE-2025-9655 O2OA Personal Profile person cross site scripting CWE-79 3.5 Low 2025-08-29
CVE-2025-9646 O2OA calendarConfig cross site scripting CWE-79 3.5 Low 2025-08-29
CVE-2024-3689 Zhejiang Land Zongheng Network Technology O2OA information disclosure CWE-200 3.7 Low 2024-04-12

All 25 known CVE vulnerabilities affecting O2OA with full Chinese analysis, references, and POCs where available.