CVE-2025-10255 | Ascensio System SIA OnlyOffice up to 12.7.0 Comment Messages.aspx cross site scripting

A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0 and classified as problematic. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting.

The identification of this vulnerability is CVE-2025-10255. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was informed early about this issue and replied: “We are already working on this case, and the issues will be resolved in one of the upcoming patches.”