CVE-2025-10091 is a high severity XML external entity flaw (CVSS 7.3) in Jinher OA up to version 1.2, in the XML handler behind /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx. The record lists no fixed version, so restrict access to the application and ask the vendor for a patch.
What's affected
The record names Jinher OA, an office automation product, up to version 1.2. The affected file is /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx, part of the XML Handler component. The manipulation leads to an XML external entity reference. The weakness classes are CWE-611 (improper restriction of XML external entity reference) and CWE-610 (externally controlled reference to a resource in another sphere).
The score is 7.3 HIGH. The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reads as network reachable, low attack complexity, no privileges and no user interaction. Impact on confidentiality is limited, on integrity limited, and on availability limited. The record says the exploit has been disclosed publicly. No fixed version is listed. I could not retrieve the vendor or researcher pages, so confirm with the vendor whether a newer release changes this.
How to check if you're exposed
- Find your Jinher OA installation and confirm the version. The record covers every version up to 1.2.
- Check whether the application is reachable from the internet, or only from an internal network.
- Search the web server logs for requests to the affected handler.
grep -i "XmlHttp.aspx\|AddTask.aspx" /path/to/iis/logs/*.log | head
- Look at which accounts can reach that part of the application, and whether the request needs authentication in your deployment.
What to do now
- Ask the vendor for a fixed release and apply it. The record does not confirm one.
- Put the application behind a VPN or an IP allowlist if it faces the internet.
- If you maintain the code, turn off DTD processing and external entity resolution in the XML parser that backs this handler. Most .NET XML parsers have settings for this.
- Block outbound connections from the application server except to the destinations it needs. External entity attacks often rely on the server making requests.
- Review logs for unexpected requests to the handler and for unusual outbound traffic.
- Check your other applications for the same parser setup. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.
Why it matters
XML lets a document define "entities" that the parser replaces with content. An external entity can point at a file path or a URL. If the parser follows it, a request can make the server read local files or contact internal systems on the requester's behalf. That is XXE, and it is prevented by a parser setting, not by cleaning the input.
Because the safe setting is a one-line change, XXE flaws usually mean a parser was left on default. The same product has other records listed with similar weaknesses, so treat one XXE report as a reason to review the whole handler family. The record is not flagged by CISA as exploited in the wild, and I found no statement saying it was.
Quick check
Is there a fixed version for CVE-2025-10091?
The record lists no fixed version, and I could not confirm one. Ask the vendor and restrict access to the application meanwhile.
What is the safest parser setting?
Disable DTD processing and external entity resolution in the XML parser. Your framework documentation lists the exact option.
Sources
- NVD record for CVE-2025-10091 and its references (not independently verified)
Last reviewed: 19 October 2026.
