CVE-2026-0588 | Low | 3.5 | 2026-01-05 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the… |
CVE-2026-0587 | Low | 3.5 | 2026-01-05 | A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover… |
CVE-2025-63742 | Critical | 9.8 | 2025-12-09 | SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive… |
CVE-2025-63740 | Medium | 4.3 | 2025-12-09 | SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information… |
CVE-2025-63739 | Medium | 4.3 | 2025-12-09 | An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authen… |
CVE-2025-63738 | Medium | 4.3 | 2025-12-09 | An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to th… |
CVE-2025-63737 | Medium | 6.1 | 2025-12-09 | Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbit… |
CVE-2025-9602 | Medium | 6.3 | 2025-08-29 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in impro… |
CVE-2024-57151 | Medium | 6.8 | 2025-03-18 | SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and the saveA… |
CVE-2024-48213 | Medium | 4.3 | 2024-10-23 | RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php. |
CVE-2024-7327 | Medium | 6.3 | 2024-07-31 | A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/op… |
CVE-2024-37624 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. component. |
CVE-2024-37623 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component. |
CVE-2024-37622 | Medium | 6.1 | 2024-06-17 | Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. |
CVE-2023-49363 | Critical | 9.8 | 2023-12-13 | Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php. |
CVE-2023-48930 | Critical | 9.8 | 2023-12-06 | xinhu xinhuoa 2.2.1 contains a File upload vulnerability. |
CVE-2023-5297 | Low | 3.7 | 2023-09-29 | A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beife… |
CVE-2023-5296 | Medium | 4.3 | 2023-09-29 | A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file a… |
CVE-2023-1773 | Medium | 6.3 | 2023-03-31 | A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the compo… |
CVE-2023-1501 | Medium | 6.3 | 2023-03-19 | A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The mani… |
CVE-2022-45041 | High | 7.5 | 2022-12-19 | SQL Injection exits in xinhu < 2.5.0 |
CVE-2020-20593 | High | 8.0 | 2021-12-22 | A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. |
CVE-2020-18716 | Critical | 9.8 | 2021-02-05 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php. |
CVE-2020-18714 | Critical | 9.8 | 2021-02-05 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function. |
CVE-2020-18713 | Critical | 9.8 | 2021-02-05 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php |
CVE-2020-21147 | Medium | 4.8 | 2021-01-26 | RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administrator and execute J… |
CVE-2020-35388 | High | 7.5 | 2020-12-26 | rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to… |
CVE-2019-9846 | High | 8.8 | 2019-06-28 | RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause… |