A vulnerability was determined in Jinher OA 2.0. The... · CVE-2025-11035 · GitHub Advisory Database · GitHub

A vulnerability was determined in Jinher OA 2.0. The...

Moderate severity Unreviewed Published Sep 26, 2025 to the GitHub Advisory Database • Updated Oct 8, 2025

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

References

Published by the National Vulnerability Database

Sep 26, 2025

Published to the GitHub Advisory Database Sep 26, 2025

Last updated Oct 8, 2025

Weaknesses

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. Learn more on MITRE.

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Learn more on MITRE.