CVE-2026-97179Medium· 4.3▾ SunlitA security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111620Medium· 5.3O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
CVE-2026-105438Medium· 4.3A flaw has been found in O2OA up to 10.0.1-ce
CVE-2013-10077Medium· 5.3OctoPrint API Key settings.py getSettings information disclosure
CVE-2022-22916Critical· 9.8O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
CVE-2025-14198Medium· 5.3A vulnerability was detected in Verysync 微力同步 2.21.3
CVE-2025-15141Low· 3.1A vulnerability was determined in Halo up to 2.21.10