VendorsZonelando2oaall versions
Vulnerabilities

Zoneland O2OA

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

25CVEs
CVE-2022-22916
O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
Published 2022-02-17 · Modified
9.8EPSS 0.387
CVE-2023-47418
Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to execute JavaScript.
Published 2023-11-30 · Modified
9.8EPSS 0.015
CVE-2024-37777
O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.
Published 2025-08-27 · Analyzed
8.8EPSS 0.005
CVE-2026-2074
O2OA HTTP POST Request check xml external entity reference
Published 2026-02-07 · Analyzed
6.5EPSS 0.003
CVE-2025-22994
O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.
Published 2025-01-31 · Analyzed
6.1EPSS 0.003
CVE-2024-3689
Zhejiang Land Zongheng Network Technology O2OA information disclosure
Published 2024-04-12 · Analyzed
5.9EPSS 0.009
CVE-2024-35591
An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
Published 2024-05-24 · Analyzed
5.4EPSS 0.004
CVE-2025-9680
O2OA Personal Profile page cross site scripting
Published 2025-08-30 · Analyzed
5.4EPSS 0.004
CVE-2025-9718
O2OA Personal Profile process cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9734
O2OA Personal Profile stat cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9736
O2OA Personal Profile statement cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9737
O2OA Personal Profile importmodel cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9681
O2OA Personal Profile agent cross site scripting
Published 2025-08-30 · Analyzed
5.4EPSS 0.003
CVE-2025-9682
O2OA Personal Profile appdict cross site scripting
Published 2025-08-30 · Analyzed
5.4EPSS 0.003
CVE-2025-9683
O2OA Personal Profile form cross site scripting
Published 2025-08-30 · Analyzed
5.4EPSS 0.003
CVE-2025-9715
O2OA Personal Profile script cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9716
O2OA Personal Profile form cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9646
O2OA calendarConfig cross site scripting
Published 2025-08-29 · Analyzed
5.4EPSS 0.003
CVE-2025-9659
O2OA Personal Profile widget cross site scripting
Published 2025-08-29 · Analyzed
5.4EPSS 0.003
CVE-2025-9657
O2OA Personal Profile script cross site scripting
Published 2025-08-29 · Analyzed
5.4EPSS 0.003
CVE-2025-9658
O2OA Personal Profile dict cross site scripting
Published 2025-08-29 · Analyzed
5.4EPSS 0.003
CVE-2025-9735
O2OA Personal Profile table cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9719
O2OA Personal Profile script cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003
CVE-2025-9655
O2OA Personal Profile person cross site scripting
Published 2025-08-29 · Analyzed
5.4EPSS 0.003
CVE-2025-9717
O2OA Personal Profile unit cross site scripting
Published 2025-08-31 · Analyzed
5.4EPSS 0.003