CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7327 – Xinhu RockOA openmodhetongAction.php dataAction sql injection
https://notcve.org/view.php?id=CVE-2024-7327
31 Jul 2024 — A vulnerability classified as critical was found in Xinhu RockOA 2.6.2. This vulnerability affects the function dataAction of the file /webmain/task/openapi/openmodhetongAction.php. The manipulation of the argument nickName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://vuldb.com/?id.273250 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6939 – Xinhu RockOA tpl_upload.html okla cross site scripting
https://notcve.org/view.php?id=CVE-2024-6939
21 Jul 2024 — A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/rainrocka/xinhu/issues/7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37622
https://notcve.org/view.php?id=CVE-2024-37622
17 Jun 2024 — Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. Se descubrió que Xinhu RockOA v2.6.3 contiene una vulnerabilidad de cross site scripting (XSS) reflejado a través del parámetro num en /flow/flow.php. • https://github.com/rainrocka/xinhu/issues/4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •