5.3
Medium
CVE-2026-2074 A vulnerability was identified in O2OA up to 9.0.0
Description
A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| O2OA | 9.0 | No fix stated |
Other CVEs of O2OA
The 23 CVEs of O2OA →
CVE-2026-105438
A flaw has been found in O2OA up to 10.0.1-ce
5.3
Medium
CVE-2026-97179
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2
5.3
Medium
CVE-2026-7292
A security vulnerability has been detected in o2oa up to 10.0
6.3
Medium
CVE-2026-7291
A weakness has been identified in o2oa up to 10.0
5.3
Medium