CVE-2025-63742

critical · 9.8

SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.

9.8

CVSS

0.4%

EPSS (exploit prob.)

35th

EPSS percentile

2025-12-09

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
rockoa	rockoa	2.7.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/rainrocka/xinhu/issues/14

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-63742