Based on the description, it is inferred that the vulnerability is a reflected cross‑site scripting flaw in the forum posting function of O2OA version 10. Attackers can embed malicious JavaScript into a crafted URL that, when accessed by a user, runs in the context of the victim’s browser. This allows an adversary to steal session cookies, deface the page, redirect the user, or perform other actions that compromise confidentiality, integrity and availability of the web application. The weakness falls under the injection family and is classified as cross‑site scripting (CWE‑79).

All installations of O2OA release 10 that expose the public forum posting endpoint and do not apply input sanitization or output encoding in the relevant handler. No further version details are officially documented.

Based on the description, it is inferred that the exploit does not require elevated privileges and relies solely on the delivery of a crafted URL to a user; therefore, the attack vector is readily achievable over the internet. The EPSS score is less than 1%, indicating a low exploitation probability, but the vulnerability is not listed in CISA KEV. The CVSS score of 6.1 classifies the flaw as medium severity; however, the real‑world risk remains high for any system that exposes the forum posting endpoint.