Rockoa

Rockoa

19 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2026-0588

  • EPSS 0.03%
  • Veröffentlicht 05.01.2026 11:32:05
  • Zuletzt bearbeitet 22.01.2026 17:15:05

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The ...

5.4

CVE-2026-0587

  • EPSS 0.03%
  • Veröffentlicht 05.01.2026 11:02:05
  • Zuletzt bearbeitet 22.01.2026 16:43:40

A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. ...

9.8

CVE-2025-63742

Exploit
  • EPSS 0.05%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:27:48

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and ot...

4.3

CVE-2025-63740

Exploit
  • EPSS 0.03%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:28:22

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical ...

4.3

CVE-2025-63739

Exploit
  • EPSS 0.04%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:29:06

An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoi...

4.3

CVE-2025-63738

Exploit
  • EPSS 0.04%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:29:27

An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.

6.1

CVE-2025-63737

Exploit
  • EPSS 0.06%
  • Veröffentlicht 09.12.2025 00:00:00
  • Zuletzt bearbeitet 12.12.2025 12:29:44

Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint.

6.5

CVE-2025-9602

Exploit
  • EPSS 0.03%
  • Veröffentlicht 29.08.2025 01:02:10
  • Zuletzt bearbeitet 11.09.2025 12:43:41

A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been ...

9.8

CVE-2023-49363

  • EPSS 0.16%
  • Veröffentlicht 13.12.2023 18:15:43
  • Zuletzt bearbeitet 21.11.2024 08:33:17

Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.

7.5

CVE-2023-5297

Exploit
  • EPSS 0.07%
  • Veröffentlicht 29.09.2023 22:15:12
  • Zuletzt bearbeitet 21.11.2024 08:41:28

A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It ...