Rockoa

Rockoa

12 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2025-9602

Exploit
  • EPSS 0.03%
  • Published 29.08.2025 01:02:10
  • Last modified 11.09.2025 12:43:41

A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been ...

9.8

CVE-2023-49363

  • EPSS 0.16%
  • Published 13.12.2023 18:15:43
  • Last modified 21.11.2024 08:33:17

Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.

7.5

CVE-2023-5296

Exploit
  • EPSS 0.05%
  • Published 29.09.2023 22:15:12
  • Last modified 21.11.2024 08:41:28

A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak...

7.5

CVE-2023-5297

Exploit
  • EPSS 0.07%
  • Published 29.09.2023 22:15:12
  • Last modified 21.11.2024 08:41:28

A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It ...

9.8

CVE-2023-1773

  • EPSS 1.69%
  • Published 31.03.2023 12:15:06
  • Last modified 21.11.2024 07:39:52

A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can b...

8.8

CVE-2023-1501

Exploit
  • EPSS 0.08%
  • Published 19.03.2023 20:15:19
  • Last modified 21.11.2024 07:39:19

A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate th...

8

CVE-2020-20593

Exploit
  • EPSS 0.12%
  • Published 22.12.2021 23:15:07
  • Last modified 21.11.2024 05:12:09

A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.

9.8

CVE-2020-18713

Exploit
  • EPSS 0.62%
  • Published 05.02.2021 14:15:15
  • Last modified 21.11.2024 05:08:44

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php

9.8

CVE-2020-18714

Exploit
  • EPSS 0.51%
  • Published 05.02.2021 14:15:15
  • Last modified 21.11.2024 05:08:44

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function.

9.8

CVE-2020-18716

Exploit
  • EPSS 0.51%
  • Published 05.02.2021 14:15:15
  • Last modified 21.11.2024 05:08:44

SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php.