Xinhu
Monthly
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.
SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and the saveAjax function. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
xinhu xinhuoa 2.2.1 contains a File upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection exits in xinhu < 2.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.
SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and before allows a remote attacker to execute arbitrary code via the inputAction.php file and the saveAjax function. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
xinhu xinhuoa 2.2.1 contains a File upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL Injection exits in xinhu < 2.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.