Browse CVEs

MEDIUM 6.1 CVE-2026-0588 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.p… Rockoa after 2.7.1 Fix from $1,6002026-01-05 MEDIUM 5.4 CVE-2026-0587 A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the compo… Rockoa after 2.7.1 Fix from $1,6002026-01-05 CRITICAL 9.8 CVE-2025-63742 SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain… Rockoa Mitigation only Fix from $2,3002025-12-09 MEDIUM 6.1 CVE-2025-63737 Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to in… Rockoa No fix yet Fix from $1,6002025-12-09 MEDIUM 6.5 CVE-2025-9602 A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation result… Rockoa after 2.6.9 Fix from $1,6002025-08-29 MEDIUM 6.8 CVE-2024-57151 SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and… Xinhu after 2.6.5 Fix from $1,6002025-03-18 HIGH 8.8 CVE-2024-7327 A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/… Xinhu No fix yet Fix from $1,9502024-07-31 MEDIUM 6.1 CVE-2024-37622 Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. Xinhu No fix yet Fix from $1,6002024-06-17 MEDIUM 6.1 CVE-2024-37623 Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html com… Xinhu No fix yet Fix from $1,6002024-06-17 MEDIUM 6.1 CVE-2024-37624 Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. component. Xinhu No fix yet Fix from $1,6002024-06-17 CRITICAL 9.8 CVE-2023-49363 Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php. Rockoa 2.3.3+ Fix from $2,3002023-12-13 CRITICAL 9.8 CVE-2023-48930 xinhu xinhuoa 2.2.1 contains a File upload vulnerability. Xinhu No fix yet Fix from $2,3002023-12-06 HIGH 7.5 CVE-2023-5296 A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of … Rockoa No fix yet Fix from $1,9502023-09-29 HIGH 7.5 CVE-2023-5297 A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|ru… Rockoa No fix yet Fix from $1,9502023-09-29 CRITICAL 9.8 CVE-2023-1773 A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of… Rockoa Mitigation only Fix from $2,3002023-03-31 HIGH 8.8 CVE-2023-1501 A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL… Rockoa No fix yet Fix from $1,9502023-03-19 HIGH 7.5 CVE-2022-45041 SQL Injection exits in xinhu < 2.5.0 Xinhu 2.5.0+ Fix from $1,9502022-12-19 HIGH 8.0 CVE-2020-20593 A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. Rockoa No fix yet Fix from $1,9502021-12-22 CRITICAL 9.8 CVE-2020-18713 SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php Rockoa No fix yet Fix from $2,3002021-02-05 CRITICAL 9.8 CVE-2020-18714 SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function. Rockoa No fix yet Fix from $2,3002021-02-05 CRITICAL 9.8 CVE-2020-18716 SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php. Rockoa No fix yet Fix from $2,3002021-02-05 HIGH 7.5 CVE-2020-35388 rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is mani… Xinhu No fix yet Fix from $1,9502020-12-26 HIGH 8.8 CVE-2019-9846 RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WH… Rockoa 1.8.7+ Fix from $1,9502019-06-28