CVE-2025-63737: XSS

Published Dec 9, 2025

Updated

Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint.

Affected Software

2 affected components

Xinhu Rainrock RockOA

Rockoa RockOA=2.7.0

Event History

Dec 9, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-63737?

CVE-2025-63737 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary scripts.

How do I fix CVE-2025-63737?

To fix CVE-2025-63737, you should update Xinhu Rainrock RockOA to the latest version that addresses this XSS vulnerability.

What is the impact of CVE-2025-63737?

The impact of CVE-2025-63737 includes unauthorized script execution, leading to possible data theft or session hijacking.

Which versions of Xinhu Rainrock RockOA are affected by CVE-2025-63737?

CVE-2025-63737 affects version 2.7.0 of Xinhu Rainrock RockOA.

What type of attack does CVE-2025-63737 facilitate?

CVE-2025-63737 facilitates cross-site scripting (XSS) attacks by allowing injection of arbitrary web scripts via the task.php endpoint.