Is there a public PoC exploit available for CVE-2026-7678?

Yes, a public proof-of-concept exploit is available for CVE-2026-7678. Prioritise patching immediately. EPSS: 0.0%.

YunaiV yudao-cloud CVE-2026-7678

Q: What is the CVSS score of CVE-2026-7678?

CVE-2026-7678 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26813 LOW

SQL Injection (CWE-89)

2026-05-03 VulDB

Java SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 03, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 03, 2026 - 05:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

May 03, 2026 - 05:15 vuln.today

Public exploit code

Analysis Generated

May 03, 2026 - 05:00 vuln.today

EUVD ID Assigned

May 03, 2026 - 04:30 euvd

EUVD-2026-26813

Analysis Generated

May 03, 2026 - 04:30 vuln.today

CVE Published

May 03, 2026 - 04:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in YunaiV yudao-cloud up to version 2026.01 allows authenticated remote attackers to execute arbitrary SQL queries via the getDataBySQL function in GoViewDataServiceImpl.java, potentially compromising confidentiality, integrity, and availability of the application database. Publicly available exploit code exists, and the vendor did not respond to early disclosure notifications.

Technical ContextAI

The vulnerability exists in the GoViewDataServiceImpl.java service class within the yudao-module-report-biz module, specifically in the getDataBySQL function which handles SQL query execution for the GoView reporting component. The root cause is CWE-89 (SQL Injection), indicating that user-supplied input is directly concatenated or improperly parameterized in SQL queries without adequate sanitization or prepared statement usage. This is a classic Java application vulnerability where dynamic SQL construction bypasses parameterized query protections. The affected product is identified via CPE cpe:2.3:a:yunaiv:yudao-cloud, confirming this is the YunaiV-developed yudao-cloud framework, an open-source rapid development platform for Java applications.

RemediationAI

Upgrade YunaiV yudao-cloud to a patched version released after 2026.01, once available from the official YunaiV repository or GitHub. Immediate remediation for organizations unable to patch immediately involves implementing parameterized queries (prepared statements) in the GoViewDataServiceImpl.getDataBySQL function to replace any dynamic SQL construction with bound parameters. Restrict database user privileges associated with the application account to minimum required permissions (e.g., read-only access if the reporting module should not modify data), limiting the impact scope of SQL injection to SELECT operations only. Implement input validation and whitelisting for any SQL-related parameters, restricting inputs to expected column names, table names, or operators from an approved list. Apply network-level access controls to restrict the reporting module endpoint to authorized internal users only, reducing the attack surface by ensuring only authenticated and authorized personnel can reach the vulnerable function. Monitor database query logs for anomalous SQL patterns indicative of injection attempts. Note: The vendor's unresponsiveness suggests community-driven patches or forks may emerge on GitHub; monitor the official yudao-cloud repository and community channels for security updates.