Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

33 records

Vendor: YunaiV Clear all filters
TI-2026-80085 CVE-2026-116016 · GHSA-g4h2-v8gg-9pg9

Authorization bypass in yudao-cloud lets users evade data scope

Priority MEDIUM 64

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00254 Published 2026-10-24 No fix listed CWE-807
TI-2026-80084 CVE-2026-116015 · GHSA-3pvc-3977-gxh7

Insecure direct object reference in yudao-cloud after-sale logs

Priority LOW 23

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary af…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-24 No fix listed CWE-639
TI-2026-74104 CVE-2026-110610 · GHSA-v372-v7rj-cgvj

Server-side request forgery in ruoyi-vue-pro via Midjourney referImageUrl

Priority MEDIUM 57

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl t…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00337 Published 2026-10-14 No fix listed CWE-918
TI-2026-64037 CVE-2026-97324 · GHSA-7jr8-533f-pxgg

Improper authorization in YunaiV ruoyi-vue-pro

Priority LOW 36

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00278 Published 2026-09-24 No fix listed CWE-266
TI-2026-64034 CVE-2026-97321 · GHSA-286g-p8ff-85fj

Injection in YunaiV ruoyi-vue-pro

Priority MEDIUM 57

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00233 Published 2026-09-24 No fix listed CWE-74
TI-2026-64033 CVE-2026-97320 · GHSA-228m-p28v-qwvj

Server-side request forgery in YunaiV ruoyi-vue-pro

Priority MEDIUM 57

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2026-09-24 No fix listed CWE-918
TI-2026-42058 CVE-2026-58448 · GHSA-f6rh-2m88-w48m

yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API

Priority MEDIUM 64

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instanc…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-06-30 Fixed in 2026.06 CWE-862
TI-2026-11453 CVE-2026-13528 · GHSA-6q7h-qg7r-3g9c

Path traversal in YunaiV ruoyi-vue-pro

Priority HIGH 70

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00648 Published 2026-06-29 No fix listed CWE-22
TI-2026-04493 CVE-2026-5148 · GHSA-mvcq-rxc9-9pvf

YunaiV yudao-cloud page sql injection

Priority LOW 23

A weakness has been identified in YunaiV yudao-cloud up to 2026.01.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00262 Published 2026-03-30 No fix listed CWE-74
TI-2026-04492 CVE-2026-5147 · GHSA-r78c-v88p-w43h

YunaiV yudao-cloud get-by-website sql injection

Priority HIGH 70

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00347 Published 2026-03-30 No fix listed CWE-74
TI-2025-09432 CVE-2025-10277 · GHSA-69f2-6mjq-5xcx

YunaiV yudao-cloud submit improper authorization

Priority MEDIUM 57

A vulnerability was detected in YunaiV yudao-cloud up to 2025.09.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00311 Published 2025-09-12 No fix listed CWE-266
TI-2025-09431 CVE-2025-10276 · GHSA-2w47-9873-w85f

YunaiV ruoyi-vue-pro transfer improper authorization

Priority MEDIUM 59

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00306 Published 2025-09-12 No fix listed CWE-266
Load more