Skip to content

Vendor

xinhu vulnerabilities

11 published CVES affecting xinhu, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
11
Critical
0
High
2
Medium
9
Low
0
Unscored
0
CISA KEV
0
Atom feed of xinhu alerts

Products

Latest xinhu CVEs

Newest publication first

  2. CVE-2026-84153 Xinhu Rainrock RockOA index.php toaddval sql injection

    Published
    MediumCVSS 5.3 EPSS 0.32%

    A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed...

  3. CVE-2026-84109 Xinhu Rainrock RockOA webmainAction.php getOrder sql injection

    Published
    MediumCVSS 5.3 EPSS 0.32%

    A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a manipulation of the argument highorder can lead to sql injection. The attack can be launched remotely. The explo...

  4. CVE-2026-0588 Xinhu Rainrock RockOA API rockfun.php cross site scripting

    Published
    MediumCVSS 5.1 EPSS 0.22%

    A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remote...

  6. CVE-2025-9602 Xinhu RockOA index.php publicsaveAjax improper authorization

    Published
    MediumCVSS 5.3 EPSS 0.28%

    A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

  7. CVE-2024-7327 Xinhu RockOA openmodhetongAction.php dataAction sql injection

    Published
    MediumCVSS 5.3 EPSS 0.51%

    A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php. The manipulation of the argument nickName leads to sql injection. The attack can be initiated remo...

  8. CVE-2024-6939 Xinhu RockOA tpl_upload.html okla cross site scripting

    Published
    MediumCVSS 5.3 EPSS 0.45%

    A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack may be launched remot...

  10. CVE-2023-5297 Xinhu RockOA start backup

    Published
    HighCVSS 7.5 EPSS 0.83%

    A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to initiate the at...

  11. CVE-2023-5296 Xinhu RockOA Password password recovery

    Published
    HighCVSS 7.5 EPSS 0.51%

    A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password recovery. The attack...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.