Jinher OA
CVE-2025-11341
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted XML to WebDesign.aspx
-
DeliveryInject malicious DOCTYPE with external entity
-
ExploitXML parser resolves entity to local file or internal URL
-
ExecutionServer returns file content or SSRF response
-
ImpactAttacker reads sensitive server files or probes internal network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V4 - API and Web Service External resource reference control
|
| Exploitation Conditions | The vulnerable endpoint /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx must be network-accessible, which is consistent with standard Jinher OA web deployments. No authentication is required per the CVSS 4.0 PR:N metric. The application must be running Jinher OA version 2.0 or earlier. The e-form designer module (eformaspx) must be installed and enabled - organizations that have not deployed this module are not affected. Exploitation is limited to environments where XML input to this endpoint is processed by a parser with external entity resolution enabled, which appears to be the default configuration. No client-side user interaction is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L and E:P) assigns a score of 5.5 Medium, reflecting unauthenticated network reachability but limited impact per instance. This is consistent with a constrained XXE where entity resolution is enabled but output reflection is partial or filtered. EPSS at 0.03% (10th percentile) indicates very low observed exploitation activity despite the public POC, suggesting the product's niche deployment limits attacker interest. No CISA KEV listing. The combination of public POC, unauthenticated access, and low complexity makes this a realistic threat specifically for organizations running Jinher OA - but the low EPSS and limited impact ratings argue against emergency-tier prioritization in most environments. The publicly-facing nature of a web endpoint (AV:N/PR:N) is the primary risk amplifier. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP GET or POST request to the publicly accessible WebDesign.aspx endpoint containing a malicious XML payload with an external entity declaration referencing a local file (e.g., file:///etc/passwd or a Windows credential file). The server's XML parser resolves the entity and reflects file contents in the response or an error message, enabling server-side file read. A public POC demonstrating this technique is available at the GitHub issue linked in the NVD references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to interact with the application's XML parser via a crafted request to the WebDesign.aspx endpoint. Exploitation can result in limited server-side file disclosure, server-side request forgery toward internal resources, or partial availability disruption through entity expansion. A public proof-of-concept exploit has been released on GitHub, though EPSS indicates very low exploitation probability (0.03%, 10th percentile), suggesting no widespread opportunistic scanning at time of analysis.
RemediationAI
No vendor-released patch or official advisory was identified in the reference data at time of analysis; the vulnerability is sourced solely through VulDB (vuldb.com/?id.327226) and a community POC. Organizations running Jinher OA should contact the vendor (Jinher Software) directly for a security patch. As a compensating control, restrict network access to the WebDesign.aspx endpoint (specifically the type=SystemUserInfo query parameter path) via WAF rules or reverse proxy ACLs - this prevents unauthenticated external access while preserving internal workflow functionality. Additionally, configuring the XML parser to disable external entity resolution (setting DOCTYPE processing to deny) at the application or server level would neutralize the root cause if source-level changes are available. If the e-form designer module is not operationally required, disabling it entirely eliminates the attack surface with no functional trade-off for end users.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jinher OA (Office Automation) is a Chinese-market enterprise workflow and document management platform developed by Jinher Software (CPE: cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*). The vulnerable endpoint is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx with query parameters type=SystemUserInfo&style=1, which processes user-controlled XML input without disabling external entity resolution. The root cause is CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) - a subclass of XXE where an attacker-supplied DOCTYPE or entity declaration causes the XML parser to fetch or include external resources. The path structure (eformaspx) indicates the vulnerability resides in the e-form designer module, which commonly accepts XML-structured form definitions.
Know when Jinher Oa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable unauthenticated endpoint; XXE yields limited file read (C:L) and DoS potential (A:L) but no confirmed write path (I:N).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Affected Products (CPE)CVE.org
A flaw has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitab
XML External Entity (XXE) processing vulnerability in Jinher OA 1.1 allows unauthenticated remote attackers to read loca
XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and
CVE-2025-7523 is an XML External Entity (XXE) injection vulnerability in Jinher OA 1.0 affecting the /c6/Jhsoft.Web.mess
A security flaw has been discovered in Jinher OA 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely e
A vulnerability has been found in Jinher OA 1.0.aspx. Rated medium severity (CVSS 6.9), this vulnerability is remotely e
A vulnerability was found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely explo
A vulnerability has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely
A vulnerability was detected in Jinher OA 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
A vulnerability was determined in Jinher OA 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploi
Exploit-DB