Cross Site Scripting Vulnerability in O2OA Meetings Settings
CVE-2025-22994

6.1MEDIUM

Key Information:

Vendor

O2OA

Status
O2OA
Vendor
CVE Published:
31 January 2025

What is CVE-2025-22994?

The O2OA application version 9.1.3 contains a Cross Site Scripting vulnerability within the Meetings - Settings feature. This flaw enables an attacker to inject malicious scripts into the web page, potentially allowing unauthorized access to sensitive data or executing unwanted actions on behalf of the user.

References

https://github.com/o2oa/o2oa/issues/167

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.