CVE-2025-11035 is a medium severity (CVSS 6.3) XML external entity flaw in Jinher Jinher OA 2.0. It sits in the ManageWord.aspx toolbar page and can be reached remotely. The record lists no fixed version, so restrict access to the app now and ask the vendor for a patch.
What's affected
The record names Jinher OA 2.0, in the page /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx, called with a text parameter that selects a GetUrl action. NVD scores it 6.3 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Weakness classes: CWE-610, CWE-611.
No fixed version is listed. The record points to a public GitHub issue and VulDB entries, and none of those names a patched release.
How to check if you're exposed
Confirm whether any Jinher OA 2.0 server is reachable, internally or externally. Your asset list or the vendor install folder will show it. Then look at your web logs for requests to ManageWord.aspx that you cannot explain.
grep -i "ManageWord.aspx" /path/to/your/iis/or/web/access.log | head
Replace the log path with the one your server uses. If the page is reachable from outside the company, assume it needs a fix or a block.
What to do now
- List every Jinher OA instance and its version.
- Block external access to the app at the firewall or reverse proxy until the vendor responds.
- Contact Jinher for a patched build and ask for it in writing.
- Have your developers confirm that XML parsers in the app disable DTD and external entity processing.
- Review outbound traffic from the app server, and block it where it has no reason to reach out.
Why it matters
XML external entity flaws happen when a parser is allowed to follow references inside a document, so a crafted file can make the server read local files or contact other systems. The weakness is listed under CWE-611, with CWE-610 for the externally controlled reference.
The score is medium, but the impact depends on what the OA server can reach, and the record gives no detail on that. A system that holds internal documents and sits near other services makes a bigger target than the number suggests. Disabling external entity processing in the parser is the standard defence.
Quick check
What does the medium score leave out?
It cannot know what your OA server can reach. A system near sensitive files or internal services deserves faster action.
What is the general fix?
Turn off DTD and external entity handling in every XML parser the application uses.
Sources
- NVD record for CVE-2025-11035
- Reference listed in the record
- Reference listed in the record
- Safeguard Gold page for CVE-2025-11035
Last reviewed: 19 October 2026.
