Is there a public PoC exploit available for CVE-2025-7823?

Yes, a public proof-of-concept exploit is available for CVE-2025-7823. Prioritise patching immediately. EPSS: 0.1%.

Jinher OA CVE-2025-7823

Q: What is the CVSS score of CVE-2025-7823?

CVE-2025-7823 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

2025-07-19 cna@vuldb.com

XXE Jinher Oa Jinher

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network attack vector, low complexity, no privileges; default XXE impact is low for all three CIA dimensions.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:18 vuln.today

CVE Published

Jul 19, 2025 - 13:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and potentially exfiltrate data via the ProjectScheduleDelete.aspx endpoint. Exploit code is publicly available, but the EPSS exploitation probability remains low (0.07%) and the vulnerability is not known to be actively exploited.

Technical ContextAI

Jinher OA is a .NET-based office automation platform. The vulnerable ProjectScheduleDelete.aspx page accepts XML data without disabling external entity processing, allowing attackers to inject malicious XML declarations. This falls under CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) as the parser is tricked into accessing external resources, which can be used for local file disclosure or server-side request forgery.

RemediationAI

No vendor-released patch is available at this time. As a mitigation, disable XML external entity processing in the application's XML parser configuration (e.g., set DtdProcessing to Prohibit or Ignore in .NET). Block network requests to internal services from the application server if possible. Additionally, restrict access to ProjectScheduleDelete.aspx to trusted users only, though this does not prevent authenticated exploitation. Monitor for unusual server-side request forgery patterns.