Vulnerability · Published Sep 22, 2025 · Assigned by VulDB
CVE-2025-10816Jinher OA XML text xml external entity reference
High 7.3
In plain English
A high-severity XML external entity in OA from Jinher. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
Affected products (as reported)
Weakness: CWE-611, CWE-610 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-325174 | Jinher OA XML text xml external entity reference vdb-entry
- VDB-325174 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #654466 | Jinher OA V2.0 XML External Entity Reference third-party-advisory
- https://github.com/1296299554/CVE/issues/1 exploit, issue-tracking