zoneland records

25 published records for vendor zoneland.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 4
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

25 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
51Plan	CVE-2022-22916Proof of concept	O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.zoneland · o2oa pre-auth RCE	Critical9.8	38.6%Feb 17, 2022
39Monitor	CVE-2023-47418No exploit	Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service managezoneland · o2oa pre-auth RCE	Critical9.8	1.5%Nov 30, 2023
35Monitor	CVE-2024-37777No exploit	O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.zoneland · o2oa · CWE-20 pre-auth RCE	High8.8	0.5%Aug 27, 2025
24Monitor	CVE-2025-22994No exploit	O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.zoneland · o2oa · CWE-79 Pre-auth XSS	Medium6.1	0.2%Jan 31, 2025
23Monitor	CVE-2024-3689No exploit	Zhejiang Land Zongheng Network Technology O2OA information disclosurezoneland · o2oa · CWE-200 Pre-auth Info leak	Medium5.9	0.8%Apr 12, 2024
21Monitor	CVE-2024-35591No exploit	An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.zoneland · o2oa · CWE-79 pre-auth RCE File upload XSS	Medium5.4	0.4%May 24, 2024
20Monitor	CVE-2025-9655No exploit	O2OA Personal Profile person cross site scriptingzoneland · o2oa · CWE-79 XSS	Medium5.1	0.2%Aug 29, 2025
8Monitor	CVE-2025-9680No exploit	O2OA Personal Profile page cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.4%Aug 30, 2025
8Monitor	CVE-2025-9736No exploit	O2OA Personal Profile statement cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 31, 2025
8Monitor	CVE-2025-9734No exploit	O2OA Personal Profile stat cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 31, 2025
8Monitor	CVE-2025-9737No exploit	O2OA Personal Profile importmodel cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 31, 2025
8Monitor	CVE-2025-9718No exploit	O2OA Personal Profile process cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 31, 2025
8Monitor	CVE-2025-9681No exploit	O2OA Personal Profile agent cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 30, 2025
8Monitor	CVE-2025-9682No exploit	O2OA Personal Profile appdict cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 30, 2025
8Monitor	CVE-2025-9683No exploit	O2OA Personal Profile form cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 30, 2025
8Monitor	CVE-2025-9715No exploit	O2OA Personal Profile script cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 31, 2025
8Monitor	CVE-2025-9716No exploit	O2OA Personal Profile form cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.3%Aug 31, 2025
8Monitor	CVE-2026-2074No exploit	O2OA HTTP POST Request check xml external entity referencezoneland · o2oa · CWE-610 XXE	Low2.1	0.3%Feb 7, 2026
8Monitor	CVE-2025-9657No exploit	O2OA Personal Profile script cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 29, 2025
8Monitor	CVE-2025-9646No exploit	O2OA calendarConfig cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 29, 2025
8Monitor	CVE-2025-9658No exploit	O2OA Personal Profile dict cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 29, 2025
8Monitor	CVE-2025-9659No exploit	O2OA Personal Profile widget cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 29, 2025
8Monitor	CVE-2025-9735No exploit	O2OA Personal Profile table cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 31, 2025
8Monitor	CVE-2025-9719No exploit	O2OA Personal Profile script cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 31, 2025
8Monitor	CVE-2025-9717No exploit	O2OA Personal Profile unit cross site scriptingzoneland · o2oa · CWE-79 XSS	Low2.0	0.2%Aug 31, 2025

CVE-2022-22916
51Plan
O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
CriticalCVSS 9.8Proof of conceptEPSS 38%
- pre-auth RCE
zoneland · o2oaFeb 17, 2022
CVE-2023-47418
39Monitor
Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service manage
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
zoneland · o2oaNov 30, 2023
CVE-2024-37777
35Monitor
O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
zoneland · o2oaAug 27, 2025
CVE-2025-22994
24Monitor
O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
zoneland · o2oaJan 31, 2025
CVE-2024-3689
23Monitor
Zhejiang Land Zongheng Network Technology O2OA information disclosure
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- Info leak
zoneland · o2oaApr 12, 2024
CVE-2024-35591
21Monitor
An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
MediumCVSS 5.4No exploitEPSS 0%
- pre-auth RCE
- File upload
- XSS
zoneland · o2oaMay 24, 2024
CVE-2025-9655
20Monitor
O2OA Personal Profile person cross site scripting
MediumCVSS 5.1No exploitEPSS 0%
- XSS
zoneland · o2oaAug 29, 2025
CVE-2025-9680
8Monitor
O2OA Personal Profile page cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 30, 2025
CVE-2025-9736
8Monitor
O2OA Personal Profile statement cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9734
8Monitor
O2OA Personal Profile stat cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9737
8Monitor
O2OA Personal Profile importmodel cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9718
8Monitor
O2OA Personal Profile process cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9681
8Monitor
O2OA Personal Profile agent cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 30, 2025
CVE-2025-9682
8Monitor
O2OA Personal Profile appdict cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 30, 2025
CVE-2025-9683
8Monitor
O2OA Personal Profile form cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 30, 2025
CVE-2025-9715
8Monitor
O2OA Personal Profile script cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9716
8Monitor
O2OA Personal Profile form cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2026-2074
8Monitor
O2OA HTTP POST Request check xml external entity reference
LowCVSS 2.1No exploitEPSS 0%
- XXE
zoneland · o2oaFeb 7, 2026
CVE-2025-9657
8Monitor
O2OA Personal Profile script cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 29, 2025
CVE-2025-9646
8Monitor
O2OA calendarConfig cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 29, 2025
CVE-2025-9658
8Monitor
O2OA Personal Profile dict cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 29, 2025
CVE-2025-9659
8Monitor
O2OA Personal Profile widget cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 29, 2025
CVE-2025-9735
8Monitor
O2OA Personal Profile table cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9719
8Monitor
O2OA Personal Profile script cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025
CVE-2025-9717
8Monitor
O2OA Personal Profile unit cross site scripting
LowCVSS 2.0No exploitEPSS 0%
- XSS
zoneland · o2oaAug 31, 2025