Vulnerabilities

TI-2024-37800 CVE-2024-57151 · GHSA-cqjc-pfg6-24mx

SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote…

HIGH 71

SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and the saveAjax function

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00457 Published 2025-03-18 No fix listed CWE-89

TI-2024-32305 CVE-2024-48213 · GHSA-8rm2-54v5-9c84

RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.

LOW 21

RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0065 Published 2024-10-23 No fix listed CWE-22

TI-2024-06788 CVE-2024-7327 · GHSA-g8rf-63h9-mw87

Xinhu RockOA openmodhetongAction.php dataAction sql injection

MEDIUM 57

A vulnerability classified as critical was found in Xinhu RockOA 2.6.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00514 Published 2024-07-31 No fix listed CWE-89

TI-2024-25087 CVE-2024-37624 · GHSA-w6vc-qv7j-67ph

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00333 Published 2024-06-17 No fix listed CWE-79

TI-2024-25086 CVE-2024-37623 · GHSA-5f56-q773-9mqx

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00301 Published 2024-06-17 No fix listed CWE-79

TI-2024-25085 CVE-2024-37622 · GHSA-gj92-fpwq-8c5r

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0027 Published 2024-06-17 No fix listed CWE-79

TI-2023-26688 CVE-2023-48930 · GHSA-w2c3-3jv2-f439

xinhu xinhuoa 2.2.1 contains a File upload vulnerability.

HIGH 82

xinhu xinhuoa 2.2.1 contains a File upload vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01166 Published 2023-12-06 No fix listed CWE-434

TI-2022-22140 CVE-2022-45041 · GHSA-m95m-9r23-75rh

SQL Injection exits in xinhu < 2.5.0

MEDIUM 40

SQL Injection exits in xinhu < 2.5.0

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00792 Published 2022-12-19 No fix listed CWE-89

TI-2020-17964 CVE-2020-35388 · GHSA-5m5r-ch84-vh95

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an…

LOW 36

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01489 Published 2020-12-26 No fix listed

Vulnerabilities

Filters