Vulnerability · Published Jul 13, 2025 · Assigned by VulDB
CVE-2025-7523Jinher OA DelTemp.aspx xml external entity reference
High 7.3
In plain English
A high-severity XML external entity in OA from Jinher. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-611, CWE-610 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-316220 | Jinher OA DelTemp.aspx xml external entity reference vdb-entry
- VDB-316220 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #611183 | jinhe OA V1.0 XML External Entity Reference third-party-advisory
- https://github.com/BigMancer/Jinhe-OA-XXE-Vulnerability related
- https://github.com/BigMancer/Jinhe-OA-XXE-Vulnerability?tab=readme-ov-file#proof-of-concept exploit