CVE-2025-63740

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.

CVSS 3.1

4.3CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2025-12-09

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• rockoa:rockoa

References

• https://github.com/rainrocka/xinhu/issues/13

Check your stackJSON