CVE-2019-9846: Rockoa

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.

Affected products

• Rockoa Rockoa: before 1.8.7 (fixed in 1.8.7)

Published 2019-06-28. Last modified 2026-06-17.