CVE-2025-63737

Xinhu Rainrock RockOA 2.7.0 is affected by a Cross-site Scripting (XSS) vulnerability in the urltestAction function of cliAction.php. The issue allows remote attackers to inject arbitrary web scripts or HTML via the m parameter to the /task.php endpoint. The attack surface is the RockOA 2.7.0 dep...