5.3
Medium
CVE-2026-2074 A vulnerability was identified in O2OA up to 9.0.0
Description
A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| O2OA | 9.0 | No fix stated |
References
- VDB-344640 | O2OA HTTP POST Request check xml external entity reference vuldb.com
- VDB-344640 | CTI Indicators (IOB, IOC, IOA) vuldb.com
- Submit #745486 | 浙江兰德纵横网络技术股份有限公司 O2OA v6.1.0 至 v9.0.0 XML实体注入漏洞 vuldb.com
- Submit #745489 | O2OA开发平台 O2OA v6.1.0 至 v9.0.0 XML实体注入漏洞 (Duplicate) vuldb.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of O2OA
The 23 CVEs of O2OA →
CVE-2026-105438
A flaw has been found in O2OA up to 10.0.1-ce
5.3
Medium
CVE-2026-97179
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2
5.3
Medium
CVE-2026-7292
A security vulnerability has been detected in o2oa up to 10.0
6.3
Medium
CVE-2026-7291
A weakness has been identified in o2oa up to 10.0
5.3
Medium