Xinhu

Rockoa

9 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2026-0588

  • EPSS 0.03%
  • Veröffentlicht 05.01.2026 11:32:05
  • Zuletzt bearbeitet 22.01.2026 17:15:05

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The ...

6.1

CVE-2025-63737

Exploit
  • EPSS 0.06%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:29:44

Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint.

4.3

CVE-2025-63738

Exploit
  • EPSS 0.04%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:29:27

An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.

4.3

CVE-2025-63739

Exploit
  • EPSS 0.04%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:29:06

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoi...

4.3

CVE-2025-63740

Exploit
  • EPSS 0.03%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:28:22

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical ...

9.8

CVE-2025-63742

Exploit
  • EPSS 0.05%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:27:48

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and ot...

6.5

CVE-2025-9602

Exploit
  • EPSS 0.03%
  • Veröffentlicht 29.08.2025 01:02:10
  • Zuletzt bearbeitet 11.09.2025 12:43:41

A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been ...

6.1

CVE-2024-6939

Exploit
  • EPSS 0.17%
  • Veröffentlicht 21.07.2024 05:15:04
  • Zuletzt bearbeitet 21.11.2024 09:50:35

A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. Th...

6.1

CVE-2024-37622

Exploit
  • EPSS 0.85%
  • Veröffentlicht 17.06.2024 14:15:11
  • Zuletzt bearbeitet 30.04.2025 23:53:02

Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.