Security Advisory
CVE-2025-63742
9.8
CRITICAL
Vulnerability Description
SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters.
Published Date
December 9, 2025
Official Source
NIST NVD Advisory