Xinhu vulnerabilities
We track 4 vulnerabilities in Xinhu products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 11, 2026.
Latest Xinhu vulnerabilities
- 7.3 High severity
Rainrock RockOA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injectio
- 8.8 High severity
RockOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php. The manipulation of the argument nickName leads to sql injection. The attack c
- 7.5 High severity
RockOA: Files or Directories Accessible to External Parties
A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possibl
- 7.5 High severity
RockOA: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password