Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')