Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')