Jinher Oa
Monthly
XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to interact with the application's XML parser via a crafted request to the WebDesign.aspx endpoint. Exploitation can result in limited server-side file disclosure, server-side request forgery toward internal resources, or partial availability disruption through entity expansion. A public proof-of-concept exploit has been released on GitHub, though EPSS indicates very low exploitation probability (0.03%, 10th percentile), suggesting no widespread opportunistic scanning at time of analysis.
A vulnerability was determined in Jinher OA 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Jinher OA 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Jinher OA 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Jinher OA 1.0.aspx. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XML External Entity (XXE) processing vulnerability in Jinher OA 1.1 allows unauthenticated remote attackers to read local files or perform server-side request forgery via the XmlHttp.aspx endpoint. Public exploit code is available, though no active exploitation has been reported and EPSS indicates low exploitation probability.
XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and potentially exfiltrate data via the ProjectScheduleDelete.aspx endpoint. Exploit code is publicly available, but the EPSS exploitation probability remains low (0.07%) and the vulnerability is not known to be actively exploited.
CVE-2025-7523 is an XML External Entity (XXE) injection vulnerability in Jinher OA 1.0 affecting the /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx endpoint. An unauthenticated remote attacker can exploit this to read sensitive files, modify data, or cause denial of service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to interact with the application's XML parser via a crafted request to the WebDesign.aspx endpoint. Exploitation can result in limited server-side file disclosure, server-side request forgery toward internal resources, or partial availability disruption through entity expansion. A public proof-of-concept exploit has been released on GitHub, though EPSS indicates very low exploitation probability (0.03%, 10th percentile), suggesting no widespread opportunistic scanning at time of analysis.
A vulnerability was determined in Jinher OA 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Jinher OA 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Jinher OA 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Jinher OA 1.0.aspx. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XML External Entity (XXE) processing vulnerability in Jinher OA 1.1 allows unauthenticated remote attackers to read local files or perform server-side request forgery via the XmlHttp.aspx endpoint. Public exploit code is available, though no active exploitation has been reported and EPSS indicates low exploitation probability.
XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and potentially exfiltrate data via the ProjectScheduleDelete.aspx endpoint. Exploit code is publicly available, but the EPSS exploitation probability remains low (0.07%) and the vulnerability is not known to be actively exploited.
CVE-2025-7523 is an XML External Entity (XXE) injection vulnerability in Jinher OA 1.0 affecting the /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx endpoint. An unauthenticated remote attacker can exploit this to read sensitive files, modify data, or cause denial of service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.