CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7327 – Xinhu RockOA openmodhetongAction.php dataAction sql injection
https://notcve.org/view.php?id=CVE-2024-7327
A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php. The manipulation of the argument nickName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://vuldb.com/?id.273250 https://vuldb.com/?ctiid.273250 https://vuldb.com/?submit.378320 https://wiki.shikangsi.com/post/share/789dad54-851b-4ec6-a1f6-11271e30db71 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6939 – Xinhu RockOA tpl_upload.html okla cross site scripting
https://notcve.org/view.php?id=CVE-2024-6939
A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/rainrocka/xinhu/issues/7 https://vuldb.com/?ctiid.271994 https://vuldb.com/?id.271994 https://vuldb.com/?submit.372744 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •