Yonyou

By the Year

In 2026 there have been 20 vulnerabilities in Yonyou with an average score of 7.3 out of ten. Last year, in 2025 Yonyou had 8 security vulnerabilities published. That is, 12 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.40.

Recent Yonyou Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-1179	Jan 19, 2026	SQLi via folderid in Yonyou KSOA 9.0 HTTP GET Handler A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1178	Jan 19, 2026	Yonyou KSOA 9.0 SQLi via folderid in HTTP GET Parameter Handler A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1177	Jan 19, 2026	Yonyou KSOA 9.0 SQLi via GET Parameter in save_folder.jsp A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1133	Jan 19, 2026	Yonyou KSOA 9.0 SQLi via folderid Parameter (HTTP GET) in folder.jsp A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1132	Jan 19, 2026	Yonyou KSOA 9.0 SQLi via GET folderid in /kmf/edit_folder.jsp A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument folderid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1131	Jan 19, 2026	Yonyou KSOA 9.0 SQLi via catalogid in HTTP GET Param Handler A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument catalogid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1130	Jan 19, 2026	Yonyou KSOA 9.0 SQLi via GET ID in /worksheet/worksadd_plan.jsp A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1129	Jan 19, 2026	SQL Injection via ID param in Yonyou KSOA 9.0 /worksheet/worksadd.jsp A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1124	Jan 18, 2026	SQLi in Yonyou KSOA 9.0 via /worksheet/work_report.jsp ID param A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1123	Jan 18, 2026	SQL injection via HTTP GET ID in Yonyou KSOA 9.0 component A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Handler. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1122	Jan 18, 2026	SQL Injection via ID Param in Yonyou KSOA 9.0 A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1121	Jan 18, 2026	Yonyou KSOA 9.0 SQLi in del_workplan.jsp (HTTP GET) A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2026-1120	Jan 18, 2026	Yonyou KSOA 9.0: SQLi via /worksheet/del_work.jsp A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15436	Jan 02, 2026	Yonyou KSOA 9.0 SQLi on /worksheet/work_edit.jsp via Report param A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15435	Jan 02, 2026	Yonyou KSOA 9.0 Worksheet JSP SQLi Remote A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. This manipulation of the argument Report causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15434	Jan 02, 2026	Yonyou KSOA 9.0 SQLi via PrintZPYG.jsp zpjhid (remote) A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argument zpjhid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15425	Jan 02, 2026	Yonyou KSOA 9.0 SQLi via ID in del_user.jsp A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15424	Jan 02, 2026	Yonyou KSOA 9.0 SQLi via HTTP GET ID in /worksheet/agent_worksdel.jsp A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15421	Jan 02, 2026	SQLi in Yonyou KSOA 9.0 via ID param in /worksheet/agent_worksadd.jsp A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-15420	Jan 02, 2026	Yonyou KSOA 9.0 - SQLi via /worksheet/agent_work_report.jsp ID (remote) A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ksoa
CVE-2025-14185	Dec 07, 2025	Yonyou U8 Cloud 5.x Remote SQLi via AppServletService.usercode A vulnerability was identified in Yonyou U8 Cloud 5.0/5.0sp/5.1/5.1sp. The affected element is an unknown function of the file nc/pubitf/erm/mobile/appservice/AppServletService.class. Such manipulation of the argument usercode leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-12344	Oct 28, 2025	Yonyou U8 Cloud <=5.1sp Unrestricted Upload via Request Header Handler A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	U8 Cloud
CVE-2025-34039	Jun 24, 2025	Yonyou UFIDA NC 6.5 <RCE via bsh.servlet.BshServlet> A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.	Ufida Nc
CVE-2025-3562	Apr 14, 2025	Yonyou YonBIP MA2.7 Path Traversal via FileInputStream A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the file /mobsm/common/userfile. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Yonbip
CVE-2025-2712	Mar 24, 2025	XSS in Yonyou UFIDA ERP-NC 5.0 top.jsp via langcode A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ufida Erp Nc
CVE-2025-2711	Mar 24, 2025	Yonyou UFIDA ERP-NC 5.0 XSS via /help/systop.jsp langcode A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The manipulation of the argument langcode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ufida Erp Nc
CVE-2025-2710	Mar 24, 2025	XSS in Yonyou UFIDA ERP-NC 5.0 /menu.jsp flag attack A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manipulation of the argument flag leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ufida Erp Nc
CVE-2025-2709	Mar 24, 2025	Yonyou UFIDA ERP-NC 5.0 XSS via /login.jsp key/redirect A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The manipulation of the argument key/redirect leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Ufida Erp Nc
CVE-2023-51925	Jan 20, 2024	YonBIP 3.23.05 Arbitrary File Upload (ArcpUploadAction) An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.	Yonbip
CVE-2023-51924	Jan 20, 2024	Arbitrary File Upload in YonBIP v3.23.05 via IResourceManager An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.	Yonbip
CVE-2023-51906	Jan 20, 2024	Remote Code Execution YonBIP v3_23.05 ServiceDispatcherServlet (IResourceManager) An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.	Yonbip
CVE-2023-51926	Jan 20, 2024	YonBIP v3.23.05 CommonServletDispatcher: Arbitrary File Read YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component.	Yonbip
CVE-2023-51928	Jan 20, 2024	YonBIP v3.23.05: Arbitrary File Upload in ArcpUploadAction Allows RCE An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.	Yonbip
CVE-2023-51927	Jan 20, 2024	SQL Injection in YonBIP v3.23.05 AttendScriptController.runScript() (Java) YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method.	Yonbip
CVE-2023-4748	Sep 05, 2023	Yongyou UFIDA-NC PrintTemplateFileServlet Path Traversal CVE-2023-4748 A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238637 was assigned to this vulnerability.	Ufida Nc
CVE-2022-26263	Mar 25, 2022	Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.	U8
CVE-2021-41746	Oct 29, 2021	SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information.	Turbocrm
CVE-2021-41744	Oct 22, 2021	All versions of yongyou PLM are affected by a command injection issue All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions.	Ufida Product Lifecycle Management