Approved changes feed: RSS · Atom
cpe:2.3:a:rockoa:rockoa:2.7.0:*:*:*:*:*:*:*
part: a version: 2.7.0 update: *
| Vendor | Rockoa (7969e6c1-fcd5-5f24-ba0f-986615550020) |
|---|---|
| Product | Rockoa (53502bb1-c1dd-54e7-bfff-8b38ec1fdc74) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/garylai578/rockoa |
purl2cpe | 2026-06-01 10:13:17.060292 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-63742 |
vulnerable | 2026-06-08 07:39:17.790863 |
Details available
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.
Published: 2025-12-09T00:00:00.000Z
Updated: 2025-12-11T19:16:58.188Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63740 |
vulnerable | 2026-06-08 07:39:17.790515 |
Details available
SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.
Published: 2025-12-09T00:00:00.000Z
Updated: 2025-12-10T21:12:43.640Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63739 |
vulnerable | 2026-06-08 07:39:17.790141 |
Details available
An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint.
Published: 2025-12-09T00:00:00.000Z
Updated: 2025-12-11T16:57:09.143Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63738 |
vulnerable | 2026-06-08 07:39:17.789888 |
Details available
An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.
Published: 2025-12-09T00:00:00.000Z
Updated: 2025-12-10T21:08:53.463Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63737 |
vulnerable | 2026-06-08 07:39:17.789541 |
Details available
Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint.
Published: 2025-12-09T00:00:00.000Z
Updated: 2025-12-10T21:05:40.180Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.