Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (5 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-63737 2 Rockoa, Xinhu 2 Rockoa, Rockoa 2025-12-12 6.1 Medium
Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint.
CVE-2025-63738 2 Rockoa, Xinhu 2 Rockoa, Rockoa 2025-12-12 4.3 Medium
An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.
CVE-2025-63739 2 Rockoa, Xinhu 2 Rockoa, Rockoa 2025-12-12 4.3 Medium
An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authenticated users to modify PHP configuration files via the a parameter to the index.php endpoint.
CVE-2025-63740 2 Rockoa, Xinhu 2 Rockoa, Rockoa 2025-12-12 4.3 Medium
SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.
CVE-2025-63742 2 Rockoa, Xinhu 2 Rockoa, Rockoa 2025-12-12 9.8 Critical
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.