VULNERABILITY INTELLIGENCE

CVE-2025-63740

CVSS score4.3 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2025-12-09
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the actstr parameter.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89

Primary references