U8 CRM vulnerabilities

2 known vulnerabilities in U8 CRM from Yonyou. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  U8 CRM: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2023-54403Sep 30, 2026Yonyou

  Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath

• 9.8 Critical severity

  U8 CRM: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-58385Sep 15, 2026Yonyou

  Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization.