CVE-2025-10255

A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."

• CWE-79
• CWE-94

• https://hkohi.ca/vulnerability/21
• https://vuldb.com/?ctiid.323615
• https://vuldb.com/?id.323615
• https://vuldb.com/?submit.635871
• https://hkohi.ca/vulnerability/21
• https://vuldb.com/?submit.635871

Published

Sep 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1025Versions of the package cockpit-hq/cockpit before 2.4.1 are …7.7
• CVE-2025-10250A weakness has been identified in DJI Mavic Spark, Mavic Air…5
• CVE-2025-10251A vulnerability was detected in FoxCMS up to 1.24. Affected …9.8
• CVE-2025-10252A flaw has been found in SEAT Queue Ticket Kiosk up to 20250…3.1
• CVE-2025-10253A vulnerability has been found in openDCIM 23.04. This vulne…3.5
• CVE-2025-10254A vulnerability was found in Ascensio System SIA OnlyOffice …3.5
• CVE-2025-10256A NULL pointer dereference vulnerability exists in FFmpeg’s …5.5
• CVE-2025-10258Infinera DNA is vulnerable to a time-based SQL injection vul…6.3
• CVE-2025-10259Improper Validation of Specified Quantity in Input vulnerabi…5.3
• CVE-2025-1026Versions of the package spatie/browsershot before 5.0.5 are …8.6
• CVE-2025-10262Nokia SR Linux is vulnerable to local privilege escalation v…6.3
• CVE-2025-10263Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, N…9.1