Yonyou vulnerabilities
We track 29 vulnerabilities in Yonyou products across 5 products. 29 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Yonyou vulnerabilities
- 7.5 High severity
U8 CRM: Improper Limitation of a Pathname to a Restricted Directory
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath
- 7.3 High severity
KSOA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has bee
- 9.8 Critical severity
U8 CRM: Improper Neutralization of Special Elements used in an SQL Command
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization.
- 9.8 Critical severity
U8 Cloud: Deserialization of Untrusted Data
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST requ
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid results in sql injection. The attack can be launched remotely
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to sql injection. The a
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql inject
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. The attack can
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument folderid results in sql injection. The attack can
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument catalogid leads to sql injection. It is possible to launch the a
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack may be performed
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql i
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotel
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotel
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initia
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched remotely. The exploit has
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. This manipulation of the argument Report causes sql injection. The attack can be initiated remotely. The exploit has be
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack ca
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote explo
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be laun
- 9.8 Critical severity
KSOA: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been dis
- 10.0 Critical severity
UFIDA NC: Missing Authentication for Critical Functionality
A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java
- 9.8 Critical severity
Yonbip: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.
- 9.8 Critical severity
Yonbip: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.
- 9.8 Critical severity
Yonbip: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.
- 9.8 Critical severity
Yonbip: Improper Neutralization of Special Elements used in an SQL Command
YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method.