Zoneland's vulnerability profile concentrates in its O2OA collaboration and office automation platform, a modestly represented but notably prominent product in the landscape. The vendor's disclosures cluster around application-layer input handling and code generation weaknesses, including cross-site scripting, code injection, exposure of sensitive information, and externally controlled resource references, reflecting the risks inherent to a web-based workflow and content-management system. The recurring pattern of injection and XSS issues suggests a durable structural exposure in how the platform processes and renders user-supplied and external data. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Zoneland over time
Signals from CVEs in this vendor scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-22916CRITICAL O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke. | Feb 17, 2022 | 9.8 | 46 | NO | NO |
CVE-2024-37777HIGH O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. | Aug 27, 2025 | 8.8 | 28 | NO | NO |
CVE-2023-47418CRITICAL Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to execute JavaScript. | Nov 30, 2023 | 9.8 | 27 | NO | NO |
CVE-2026-2074MEDIUM A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. | Feb 7, 2026 | 6.3 | 21 | NO | NO |
CVE-2025-9734MEDIUM A security flaw has been discovered in O2OA up to 10.0-410. The impacted element is an unknown function of the file /x_query_assemble_designer/jaxrs/stat of the component Personal | Aug 31, 2025 | 5.4 | 21 | NO | NO |
CVE-2025-9680MEDIUM A vulnerability was detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_portal_assemble_designer/jaxrs/page of the component Personal Profile Page. Per | Aug 30, 2025 | 5.4 | 21 | NO | NO |
CVE-2025-9737MEDIUM A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /x_query_assemble_designer/jaxrs/importmodel of the component Personal Profile Page | Aug 31, 2025 | 5.4 | 20 | NO | NO |
CVE-2025-9736MEDIUM A security vulnerability has been detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_query_assemble_designer/jaxrs/statement of the component Personal | Aug 31, 2025 | 5.4 | 20 | NO | NO |
CVE-2025-9719MEDIUM A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_designer/jaxrs/script of the component Person | Aug 31, 2025 | 5.4 | 20 | NO | NO |
CVE-2025-9718MEDIUM A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the component Personal Pr | Aug 31, 2025 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (25 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Zoneland.
Media articles that mention a CVE ID that affects a product developed by Zoneland — matched by CVE ID, not by vendor name.