CVE-2026-0588
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
An attacker could execute script in the user's browser, potentially leading to session theft or other actions in the user's context.
Recommendation
Update Xinhu Rainrock RockOA to a version later than 2.7.1 if available, or apply mitigations (e.g., input validation).
Other vulnerabilities in Xinhu Rainrock RockOA
See all- CVE-2025-63742Critical
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.
- CVE-2026-108571High
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6, impacting the kqjcmdModel::returnchuli function in webmain/task/openapi/openkqjAction.php of the Openkqj Action component. Manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2026-84153Medium
A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-84109Medium
Xinhu Rainrock RockOA up to version 2.7.6 has an SQL injection vulnerability in the getOrder function of webmain/webmainAction.php. Manipulating the highorder argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2025-63740Medium
SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allows attackers to gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.
- CVE-2025-63739Medium
An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint.
- CVE-2025-63738Medium
An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo through the a parameter to index.php.
- CVE-2025-63737Medium
Xinhu Rainrock RockOA 2.7.0 contains a cross-site scripting (XSS) vulnerability in the urltestAction function in cliAction.php. Remote attackers can inject arbitrary web script or HTML via the m parameter to the task.php endpoint.
Original NVD description (English source)
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS