Rockoa
by Rockoa
CVEs (14)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-9602 | Med | 0.41 | 6.3 | 0.00 | Aug 29, 2025 | A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | ||
| CVE-2026-0588 | Low | 0.23 | 3.5 | 0.00 | Jan 5, 2026 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated… | ||
| CVE-2026-0587 | Low | 0.23 | 3.5 | 0.00 | Jan 5, 2026 | A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. The attack can be launched… | ||
| CVE-2023-1773 | 0.01 | — | 0.02 | Mar 31, 2023 | A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The… | |||
| CVE-2025-63739 | 0.00 | — | 0.00 | Dec 9, 2025 | An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint. | |||
| CVE-2024-48213 | 0.00 | — | 0.01 | Oct 23, 2024 | RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php. | |||
| CVE-2023-49363 | 0.00 | — | 0.01 | Dec 13, 2023 | Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php. | |||
| CVE-2023-1501 | 0.00 | — | 0.01 | Mar 19, 2023 | A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate the attack remotely. The… | |||
| CVE-2020-20593 | 0.00 | — | 0.00 | Dec 22, 2021 | A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. | |||
| CVE-2020-18716 | 0.00 | — | 0.02 | Feb 4, 2021 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php. | |||
| CVE-2020-18714 | 0.00 | — | 0.01 | Feb 4, 2021 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function. | |||
| CVE-2020-18713 | 0.00 | — | 0.02 | Feb 4, 2021 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php | |||
| CVE-2020-21147 | 0.00 | — | 0.01 | Jan 21, 2021 | RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administrator and execute JavaScript code, because webmain/flow/input/mode_emailmAction.php does not perform strict filtering. | |||
| CVE-2019-9846 | 0.00 | — | 0.02 | Mar 16, 2019 | RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection. |
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
- risk 0.23cvss 3.5epss 0.00
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated…
- risk 0.23cvss 3.5epss 0.00
A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of the component Cover Image Handler. The manipulation of the argument fengmian results in cross site scripting. The attack can be launched…
- CVE-2023-1773Mar 31, 2023risk 0.01cvss —epss 0.02
A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The…
- CVE-2025-63739Dec 9, 2025risk 0.00cvss —epss 0.00
An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint.
- CVE-2024-48213Oct 23, 2024risk 0.00cvss —epss 0.01
RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.
- CVE-2023-49363Dec 13, 2023risk 0.00cvss —epss 0.01
Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.
- CVE-2023-1501Mar 19, 2023risk 0.00cvss —epss 0.01
A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate the attack remotely. The…
- CVE-2020-20593Dec 22, 2021risk 0.00cvss —epss 0.00
A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.
- CVE-2020-18716Feb 4, 2021risk 0.00cvss —epss 0.02
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php.
- CVE-2020-18714Feb 4, 2021risk 0.00cvss —epss 0.01
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function.
- CVE-2020-18713Feb 4, 2021risk 0.00cvss —epss 0.02
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php
- CVE-2020-21147Jan 21, 2021risk 0.00cvss —epss 0.01
RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administrator and execute JavaScript code, because webmain/flow/input/mode_emailmAction.php does not perform strict filtering.
- CVE-2019-9846Mar 16, 2019risk 0.00cvss —epss 0.02
RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.