Medium severity4.8NVD Advisory· Published Jan 26, 2021· Updated Jun 17, 2026

CVE-2020-21147

Description

RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administrator and execute JavaScript code, because webmain/flow/input/mode_emailmAction.php does not perform strict filtering.

Affected products

Rockoa/Rockoa2 versions
cpe:2.3:a:rockoa:rockoa:1.9.8:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:rockoa:rockoa:1.9.8:*:*:*:*:*:*:*
- (no CPE)range: = 1.9.8
RockOA/RockOAdescription

Patches

Vulnerability mechanics

References

blog.csdn.net/adminxw/article/details/102881463nvdExploitThird Party Advisory
github.com/alixiaowei/alixiaowei.github.io/issues/2nvdExploitIssue TrackingThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000