CVE-2026-108571 | Xinhu Rainrock RockOA up to 2.7.6 Openkqj Action openkqjAction.php kqjcmdModel::returnchuli id sql injection

October 10, 2026 Yanac

A vulnerability was found in Xinhu Rainrock RockOA up to 2.7.6. It has been rated as critical. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection.

This vulnerability is tracked as CVE-2026-108571. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More