Cross Site Scripting Vulnerability in Xinhu Rainrock RockOA API
CVE-2026-0588

5.1MEDIUM

Key Information:

Vendor

Xinhu

Status
Rainrock Rockoa
Vendor
CVE Published:
5 January 2026

What is CVE-2026-0588?

A vulnerability has been identified in Xinhu Rainrock RockOA versions up to 2.7.1, stemming from an unknown functionality in the 'rockfun.php' component of its API. This flaw allows for the manipulation of the argument callback, resulting in cross-site scripting (XSS) that can be exploited remotely. Publicly available exploit techniques expose systems to potential attacks, emphasizing the importance of addressing this issue promptly. Despite being alerted to this matter, the vendor has yet to provide a response regarding a patch or mitigation strategies.

Affected Version(s)

Rainrock RockOA 2.7.0

Rainrock RockOA 2.7.1

References

https://vuldb.com/?id.339494
vdb-entrytechnical-description
https://vuldb.com/?ctiid.339494
signaturepermissions-required
https://vuldb.com/?submit.725397
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

BlackSpdier (VulDB User)
.