A vulnerability, which was classified as critical, has been found in Xinhu RockOA up to 2.6.9. Impacted is the function
publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization.
This vulnerability is reported as CVE-2025-9602. The attack is possible to be carried out remotely. Moreover, an exploit is present.
