CVE-2025-63739

Medium · 4.3

CVSS

4.3

EPSS

0.2%

Published

Dec 9, 2025

CISA due date

—

The record

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint.

Affected packages

Ecosystem	Package	Introduced	Fixed