All packages
O2OA vulnerabilities
3 known CVE vulnerabilities in O2OA, translated and rated.
- CVE-2022-22916Critical
O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.
- CVE-2026-67961High
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.
- CVE-2026-52370Medium
Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.