---
id: CVE-2025-10816
title: A security flaw has been discovered in Jinher OA 2.0
summary: >-
  A security flaw has been discovered in Jinher OA 2.0. This affects an unknown
  part of the file
  /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of
  the component XML Handler. Performing manipulation results in xml…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-610
  - CWE-611
  - CWE-611
vendor: jinher
product: jinher_oa
affected:
  - jinher_oa = 2.0
published: '2025-09-22'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10816'
references:
  - url: 'https://github.com/1296299554/CVE/issues/1'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.325174'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.325174'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.654466'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00549
epssPercentile: 0.44318
ingestedAt: '2026-10-12T14:50:33.969Z'
---

## Overview

A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

## Affected

- `jinher_oa = 2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.