CVE-2025-7523 is a high severity XML external entity (XXE) flaw (CVSS 7.3) in Jinher OA version 1.0, in the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The record lists no patched release, so limit access to the system and check with the vendor.
What's affected
The record names Jinher OA, version 1.0, and the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction, with a low impact on confidentiality, integrity and availability. The base score is 7.3.
The VulDB description rates the issue as problematic, a softer label than the High band the CVSS score puts it in. This post uses High, since that follows the score.
No fixed version appears in the record or its references. The record says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Treat all copies of version 1.0 as affected until the vendor says otherwise.
How to check if you're exposed
Start with inventory. Find out whether Jinher OA runs in your environment, including copies run by subsidiaries or by outside teams, and whether it is reachable from the internet.
Then look for the path in the record in your web server or reverse proxy logs.
grep -i "DelTemp.aspx" /path/to/access.log
Requests to that page from addresses you do not recognize are worth a closer look. Also check outbound traffic from the server for unexpected connections, since XML parsing flaws can make a server fetch resources on an attacker's behalf. If you cannot find the product in a package inventory, run a free scan at gold.safeguard.sh/scan for the components it can see, and rely on a server file search for the rest.
What to do now
- Find every Jinher OA instance you run and note which are reachable from the internet.
- Restrict access to the affected path, for example by blocking it at the reverse proxy or web application firewall, or place the system behind a VPN or allow list.
- Contact the vendor for a patched build, and do not assume one exists until they confirm it in writing.
- Ask the vendor, or review the code if you have it, to confirm the XML parser disables external entities and document type definitions.
- Limit what the server can reach. Block outbound connections from the application host except those it needs, and keep it away from internal metadata or admin services.
- Review logs for requests to the path in the record and for unusual outbound requests.
- Rescan after changes and add the system to a recurring check.
Why it matters
The record maps this to CWE-611, improper restriction of XML external entity reference, and CWE-610, externally controlled reference to a resource in another sphere. An XML parser that honors external entities can be told by the document it reads to fetch files or web addresses, so the data it processes decides what the server touches.
The usual fix is a parser setting. Turn off external entity and DTD processing, and prefer simple data formats where you can. Network egress limits give a second layer, because they stop a parser that misbehaves from reaching systems it should not.
Quick check
Is there a patched version of Jinher OA?
The record and its references do not name one. Ask the vendor, and apply access limits in the meantime.
What does an XXE flaw let someone do?
In general it lets crafted XML make the server read local files or contact other systems. The record gives a low impact on confidentiality, integrity and availability, so the exact reach here depends on how the product is deployed.
Sources
The other references in the record are public researcher write-ups and database entries. This post does not reproduce them and gives no attack steps.
Last reviewed: 18 October 2026.
