Skip to content
Noroxi

rockoa records

28 published records for vendor rockoa.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

28 records
  • CVE-2020-18713
    40Plan

    SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php

    CriticalCVSS 9.8No exploitEPSS 1%

    rockoa · rockoaFeb 5, 2021

  • CVE-2020-18716
    40Plan

    SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    rockoa · rockoaFeb 5, 2021

  • CVE-2023-1773
    39Monitor

    Rockoa Configuration File webmainConfig.php code injection

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    rockoa · rockoaMar 31, 2023

  • CVE-2020-18714
    39Monitor

    SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata fu

    CriticalCVSS 9.8No exploitEPSS 1%

    rockoa · rockoaFeb 5, 2021

  • CVE-2023-48930
    39Monitor

    xinhu xinhuoa 2.2.1 contains a File upload vulnerability.

    CriticalCVSS 9.8No exploitEPSS 1%

    rockoa · xinhuDec 5, 2023

  • CVE-2023-49363
    39Monitor

    Rockoa <2.3.3 is vulnerable to SQL Injection.

    CriticalCVSS 9.8No exploitEPSS 0%

    rockoa · rockoaDec 13, 2023

  • CVE-2025-63742
    39Monitor

    SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attac

    CriticalCVSS 9.8No exploitEPSS 0%

    rockoa · rockoaDec 9, 2025

  • CVE-2019-9846
    36Monitor

    RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs

    HighCVSS 8.8No exploitEPSS 1%

    rockoa · rockoaJun 28, 2019

  • CVE-2023-1501
    35Monitor

    RockOA acloudCosAction.php.SQL runAction unrestricted upload

    HighCVSS 8.8No exploitEPSS 0%

    rockoa · rockoaMar 19, 2023

  • CVE-2020-20593
    32Monitor

    A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.

    HighCVSS 8.0No exploitEPSS 0%

    rockoa · rockoaDec 22, 2021

  • CVE-2020-35388
    30Monitor

    rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool valu

    HighCVSS 7.5No exploitEPSS 1%

    rockoa · xinhuDec 25, 2020

  • CVE-2023-5297
    30Monitor

    Xinhu RockOA start backup

    HighCVSS 7.5No exploitEPSS 0%

    rockoa · rockoaSep 29, 2023

  • CVE-2022-45041
    30Monitor

    SQL Injection exits in xinhu < 2.5.0

    HighCVSS 7.5No exploitEPSS 0%

    rockoa · xinhuDec 19, 2022

  • CVE-2023-5296
    30Monitor

    Xinhu RockOA Password password recovery

    HighCVSS 7.5No exploitEPSS 0%

    rockoa · rockoaSep 29, 2023

  • CVE-2024-57151
    27Monitor

    SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php

    MediumCVSS 6.8No exploitEPSS 0%

    rockoa · xinhuMar 18, 2025

  • CVE-2024-37624
    24Monitor

    Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php.

    MediumCVSS 6.1No exploitEPSS 0%

    rockoa · xinhuJun 17, 2024

  • CVE-2024-37623
    24Monitor

    Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange

    MediumCVSS 6.1No exploitEPSS 0%

    rockoa · xinhuJun 17, 2024

  • CVE-2024-37622
    24Monitor

    Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.

    MediumCVSS 6.1No exploitEPSS 0%

    rockoa · xinhuJun 17, 2024

  • CVE-2025-63737
    24Monitor

    Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attack

    MediumCVSS 6.1No exploitEPSS 0%

    rockoa · rockoaDec 9, 2025

  • CVE-2024-7327
    21Monitor

    Xinhu RockOA openmodhetongAction.php dataAction sql injection

    MediumCVSS 5.3No exploitEPSS 0%

    rockoa · xinhuJul 31, 2024

  • CVE-2020-21147
    19Monitor

    RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administ

    MediumCVSS 4.8No exploitEPSS 0%

    rockoa · rockoaJan 26, 2021

  • CVE-2024-48213
    17Monitor

    RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.

    MediumCVSS 4.3No exploitEPSS 0%

    rockoa · xinhuOct 23, 2024

  • CVE-2025-63738
    17Monitor

    An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via th

    MediumCVSS 4.3No exploitEPSS 0%

    rockoa · rockoaDec 9, 2025

  • CVE-2025-63739
    17Monitor

    An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing

    MediumCVSS 4.3No exploitEPSS 0%

    rockoa · rockoaDec 9, 2025

  • CVE-2025-63740
    17Monitor

    SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sen

    MediumCVSS 4.3No exploitEPSS 0%

    rockoa · rockoaDec 9, 2025