Vendor
A SQL injection vulnerability (CVE-2026-108571) in Xinhu Rainrock RockOA versions 2.7.6 and earlier allows remote attackers to execute arbitrary database queries via the ID argument.