A vulnerability was found in Xinhu RockOA up to 2.6.9. Impacted is the function publicsaveAjax of the file /index.php. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/rainrocka/xinhu/issues/9 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/rainrocka/xinhu/issues/9#issue-3327894144 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/rainrocka/xinhu/issues/9 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/rainrocka/xinhu/issues/9#issue-3327894144 Exploit, Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 2.1 · rockoaNVD modified 2026-10-18 21:10
Affected (CPE criteria) 1
cpe:2.3:a:rockoa:rockoa:*:*:*:*:*:*:*:*
References 7
- https://github.com/rainrocka/xinhu/issues/9 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/rainrocka/xinhu/issues/9#issue-3327894144 Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.321778 Permissions Required, VDB Entry
- https://vuldb.com/?id.321778 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.636383 Third Party Advisory, VDB Entry
- https://github.com/rainrocka/xinhu/issues/9 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/rainrocka/xinhu/issues/9#issue-3327894144 Exploit, Issue Tracking, Vendor Advisory