Vulnerabilities

TI-2026-00389 CVE-2026-0588 · GHSA-h7x7-9j7c-cghf

Xinhu Rainrock RockOA API rockfun.php cross site scripting

MEDIUM 56

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00224 Published 2026-01-05 No fix listed CWE-79

TI-2026-00388 CVE-2026-0587 · GHSA-w59w-vf2m-vcq9

Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting

MEDIUM 56

A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00229 Published 2026-01-05 No fix listed CWE-79

TI-2025-39449 CVE-2025-63742 · GHSA-rgr3-x338-g7mc

SQL Injection vulnerability in function setwxqyAction in file…

MEDIUM 49

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hash…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00411 Published 2025-12-09 No fix listed CWE-89

TI-2025-39448 CVE-2025-63740 · GHSA-h8gv-f6fg-6959

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in…

MEDIUM 53

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database…

CVSS 3.1MEDIUM 4.3 Adjacent network No auth No interaction EPSS 0.00224 Published 2025-12-09 No fix listed CWE-89

TI-2025-39447 CVE-2025-63739 · GHSA-jjcj-frhf-qphh

An issue was discovered in function phpinisaveAction in file…

LOW 20

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a par…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00242 Published 2025-12-09 No fix listed CWE-284

TI-2025-39446 CVE-2025-63738 · GHSA-w82f-vrwp-wv5p

An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing…

LOW 20

An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00263 Published 2025-12-09 No fix listed CWE-98

TI-2025-39445 CVE-2025-63737 · GHSA-52f5-859w-f43q

Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php…

LOW 27

Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php e…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00262 Published 2025-12-09 No fix listed CWE-79

TI-2025-08795 CVE-2025-9602 · GHSA-f5vj-x5ww-fr7r

Xinhu RockOA index.php publicsaveAjax improper authorization

MEDIUM 57

A vulnerability was found in Xinhu RockOA up to 2.6.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00284 Published 2025-08-29 No fix listed CWE-266

TI-2024-37800 CVE-2024-57151 · GHSA-cqjc-pfg6-24mx

SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote…

HIGH 71

SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and the saveAjax function

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00457 Published 2025-03-18 No fix listed CWE-89

TI-2024-32305 CVE-2024-48213 · GHSA-8rm2-54v5-9c84

RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.

LOW 21

RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0065 Published 2024-10-23 No fix listed CWE-22

TI-2024-06788 CVE-2024-7327 · GHSA-g8rf-63h9-mw87

Xinhu RockOA openmodhetongAction.php dataAction sql injection

MEDIUM 57

A vulnerability classified as critical was found in Xinhu RockOA 2.6.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00514 Published 2024-07-31 No fix listed CWE-89

TI-2024-25087 CVE-2024-37624 · GHSA-w6vc-qv7j-67ph

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00333 Published 2024-06-17 No fix listed CWE-79

TI-2024-25086 CVE-2024-37623 · GHSA-5f56-q773-9mqx

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00301 Published 2024-06-17 No fix listed CWE-79

TI-2024-25085 CVE-2024-37622 · GHSA-gj92-fpwq-8c5r

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS)…

MEDIUM 60

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0027 Published 2024-06-17 No fix listed CWE-79

TI-2023-26964 CVE-2023-49363 · GHSA-82wr-wm9r-pf6p

Rockoa <2.3.3 is vulnerable to SQL Injection.

MEDIUM 43

Rockoa <2.3.3 is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00692 Published 2023-12-13 No fix listed CWE-89

TI-2023-26688 CVE-2023-48930 · GHSA-w2c3-3jv2-f439

xinhu xinhuoa 2.2.1 contains a File upload vulnerability.

HIGH 82

xinhu xinhuoa 2.2.1 contains a File upload vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01166 Published 2023-12-06 No fix listed CWE-434

TI-2023-04872 CVE-2023-5297 · GHSA-w36w-37xx-85wg

Xinhu RockOA start backup

HIGH 66

A vulnerability was found in Xinhu RockOA 2.3.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2023-09-29 No fix listed CWE-530

TI-2023-04871 CVE-2023-5296 · GHSA-jqc3-44qx-cq87

Xinhu RockOA Password password recovery

HIGH 72

A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00513 Published 2023-09-29 No fix listed CWE-640

TI-2023-01666 CVE-2023-1773 · GHSA-jjgj-498m-3v78

Rockoa Configuration File webmainConfig.php code injection

MEDIUM 45

A vulnerability was found in Rockoa 2.3.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01636 Published 2023-03-31 No fix listed CWE-94

TI-2023-01420 CVE-2023-1501 · GHSA-5rxg-w5rp-9mcr

RockOA acloudCosAction.php.SQL runAction unrestricted upload

MEDIUM 40

A vulnerability, which was classified as critical, was found in RockOA 2.3.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00883 Published 2023-03-19 No fix listed CWE-434

TI-2022-22140 CVE-2022-45041 · GHSA-m95m-9r23-75rh

SQL Injection exits in xinhu < 2.5.0

MEDIUM 40

SQL Injection exits in xinhu < 2.5.0

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00792 Published 2022-12-19 No fix listed CWE-89

TI-2020-13881 CVE-2020-20593 · GHSA-jcc7-g4mw-2xfw

A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to…

LOW 35

A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00446 Published 2021-12-22 No fix listed CWE-352

TI-2020-13448 CVE-2020-18716 · GHSA-wj28-g25v-jc4f

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose…

MEDIUM 46

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01779 Published 2021-02-04 No fix listed CWE-89

TI-2020-13447 CVE-2020-18714 · GHSA-wp4m-572g-9345

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose…

MEDIUM 45

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01334 Published 2021-02-04 No fix listed CWE-89

TI-2020-13446 CVE-2020-18713 · GHSA-6f25-qpmr-jpgc

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose…

MEDIUM 46

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01845 Published 2021-02-04 No fix listed CWE-89

Vulnerabilities

Filters