CVE-2026-52370

MediumCVSS 6.1

Published: 04/08/2026(UTC)Updated: 05/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.

Risk Assessment

An attacker can steal session data, take over user accounts, or perform unauthorized actions on behalf of the victim.

Recommendation

Update O2OA to the latest version that fixes this vulnerability and consider input filtering.

Other vulnerabilities in O2OA

See all

CVE-2022-22916Critical
O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.
CVE-2026-67961High
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL.