CVE-2025-10090 is a critical SQL injection vulnerability affecting Jinher OA versions up to 1.2, specifically within the /C6/Jhsoft.Web.departments/GetTreeDate.aspx file. By manipulating the 'ID' argument, an unauthenticated attacker can remotely execute arbitrary SQL commands. This flaw carries a CVSS score of 9.8 (CRITICAL), indicating a severe impact on confidentiality, integrity, and availability with low attack complexity. While not yet observed in active exploitation or listed in CISA's KEV catalog, public exploit code (Nuclei templates) is available, suggesting a high potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.2CPE matchmatch criteria | cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.