{"id":"CVE-2026-0587","state":"PUBLISHED","title":"Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting","description":"A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-01-05T11:02:05.936Z","updatedAt":"2026-02-23T08:17:24.286Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Xinhu Rainrock RockOA"],"affected":[{"vendor":"Xinhu","product":"Rainrock RockOA","versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"}],"modules":["Cover Image Handler"]}],"references":["https://vuldb.com/?id.339493","https://vuldb.com/?ctiid.339493","https://vuldb.com/?submit.725384"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/0xxx/CVE-2026-0587.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0587","state":"PUBLISHED","datePublished":"2026-01-05T11:02:05.936Z","dateUpdated":"2026-02-23T08:17:24.286Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-01-04T17:56:33.809Z"},"containers":{"cna":{"title":"Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting","descriptions":[{"lang":"en","value":"A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Xinhu","product":"Rainrock RockOA","versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"}],"modules":["Cover Image Handler"]}],"references":[{"url":"https://vuldb.com/?id.339493","name":"VDB-339493 | Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.339493","name":"VDB-339493 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.725384","name":"Submit #725384 | Xinhu Xinhu OA V2.7.1 (earlier versions may also be affected) Stored Cross-Site Scripting (XSS)","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-02-23T08:17:24.286Z"},"timeline":[{"time":"2026-01-04T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-01-04T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-01-22T18:25:32.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"BlackSpdier (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/?submit.725384","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-05T21:30:15.809368Z","id":"CVE-2026-0587","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-05T21:30:20.446Z"}}]}}}