CVE-2025-63742: Rockoa

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

Affected products

• Rockoa Rockoa: version 2.7.0 only

Published 2025-12-09. Last modified 2026-06-17.