RockOA vulnerabilities
We track 4 vulnerabilities in RockOA products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 9, 2025.
Latest RockOA vulnerabilities
- 9.8 Critical severity
Rockoa: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critic
- 8.8 High severity
RockOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php. The manipulation of the argument nickName leads to sql injection. The attack c
- 9.8 Critical severity
Rockoa: Improper Control of Generation of Code
A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiate
- 8.8 High severity
RockOA: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate the attack r