Read the docs

Yonyou

Records45All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Yonyou records in CISA KEV

No Yonyou vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ksoa 20 records HIGH Yonbip 6 records MEDIUM Ufida Erp-nc 4 records MEDIUM Turbocrm 1 record LOW U8+ 1 record MEDIUM Ufida-nc 1 record LOW Ufida Product Lifecycle Management 1 record MEDIUM Yonyou 1 record LOW

Records

45 records

TI-2025-24208 CVE-2025-34039 · GHSA-r7hr-5f7j-xxrw

Yonyou NC BeanShell Command Injection

Priority HIGH 82

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00555 Published 2025-06-24 No fix listed CWE-306
TI-2024-38464 CVE-2024-58385 · GHSA-mr5w-wpqv-h82f

Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

Priority HIGH 81

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporate…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00691 Published 2026-09-15 No fix listed CWE-89
TI-2023-30648 CVE-2023-54398 · GHSA-r89p-qrrf-vpmc

Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

Priority HIGH 81

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by se…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.012 Published 2026-09-15 No fix listed CWE-502
TI-2015-08097 CVE-2015-20122 · GHSA-jp76-j5hr-562v

Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp

Priority HIGH 77

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbi…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00476 Published 2026-09-29 No fix listed CWE-89
TI-2026-63446 CVE-2026-94491 · GHSA-rpc5-xwhw-9534

Yonyou KSOA search_list.jsp sql injection

Priority HIGH 70

A weakness has been identified in Yonyou KSOA 9.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00411 Published 2026-09-22 No fix listed CWE-74
TI-2025-14079 CVE-2025-15436 · GHSA-23rv-9x82-j4fq

Yonyou KSOA work_edit.jsp sql injection

Priority HIGH 70

A vulnerability has been found in Yonyou KSOA 9.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00447 Published 2026-01-02 No fix listed CWE-74
TI-2025-14078 CVE-2025-15435 · GHSA-rv99-x6rg-jm7h

Yonyou KSOA work_update.jsp sql injection

Priority HIGH 70

A flaw has been found in Yonyou KSOA 9.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00406 Published 2026-01-02 No fix listed CWE-74
TI-2025-14077 CVE-2025-15434 · GHSA-cmfj-6f7f-3rg9

Yonyou KSOA PrintZPYG.jsp sql injection

Priority HIGH 70

A vulnerability was detected in Yonyou KSOA 9.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00401 Published 2026-01-02 No fix listed CWE-74
Load more
Open these records in search →