CVE-2025-9931

Name of the Vulnerable Software and Affected Versions Jinher OA version 1.0

Description A cross site scripting issue exists due to the manipulation of the Account argument. The issue affects an unknown function within the file /jc6/platform/sys/login!changePassWord.action of the POST Request Handler component. The attack can be launched remotely. The exploit is now public.

Recommendations As a temporary workaround, consider restricting access to the /jc6/platform/sys/login!changePassWord.action endpoint until a fix is available. Sanitize the Account argument to prevent the injection of malicious scripts.