rocboss vulnerabilities

Products

• rocboss 1
• rocboss/paopao-ce 1

Latest rocboss CVEs

Newest publication first

1. CVE-2026-111649 Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint

   Published 2026-10-16

   High·CVSS 7.1 EPSS 0.39%

   Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/att...

2. CVE-2019-11362 app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.

   Published 2019-04-20

   Critical·CVSS 9.8 EPSS 1.6%

   app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.