o2oa vulnerabilities
CVEs whose affected-version data names the o2oa package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-111620Medium· 5.3PoCO2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream…
CVE-2026-105438Medium· 4.3PoCA flaw has been found in O2OA up to 10.0.1-ce
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argume…
CVE-2026-97179Medium· 4.3A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of …
CVE-2022-22916Critical· 9.8PoCO2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.