CVE-2025-63737

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Dec 9, 2025

CISA due date

—

The record

Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed