A cross‑site scripting weakness exists in the rockfun.php API of Xinhu Rainrock RockOA up to version 2.7.1. By sending a crafted request that manipulates the "callback" argument, an attacker can cause arbitrary script execution in the browser of victim users. The vulnerability permits injection of malicious content that is reflected by the server and executed on the client, potentially leading to session hijacking or data theft. The flaw falls under CWE‑79 and CWE‑94.

The vulnerable product is Xinhu Rainrock RockOA, all releases through 2.7.1. No other vendor or product is mentioned.

The CVSS score of 5.1 indicates a medium severity. EPSS is lower than 1 %, so exploitation likelihood is low at the time of this analysis. It is not listed in the CISA KEV catalog, implying no known massive exploitation campaigns. The attack vector is remote; an attacker can trigger the flaw over the network by calling the API with a malicious callback parameter. Publicly available exploit code has been released, so defense in depth, such as input validation or disabling the vulnerable API, is recommended.