Is there a public PoC exploit available for EUVD-2026-17168?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17168. Prioritise patching immediately. EPSS: 0.0%.

Yudao Cloud EUVD-2026-17168

Q: What is the CVSS score of EUVD-2026-17168?

EUVD-2026-17168 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5147 MEDIUM

SQL Injection (CWE-89)

2026-03-30 VulDB

GHSA-r78c-v88p-w43h

SQLi Yudao Cloud

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 19:00 euvd

EUVD-2026-17168

Analysis Generated

Mar 30, 2026 - 19:00 vuln.today

CVE Published

Mar 30, 2026 - 18:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote SQL injection in YunaiV yudao-cloud up to version 2026.01 allows unauthenticated attackers to execute arbitrary SQL queries via the Website parameter in the /admin-api/system/tenant/get-by-website endpoint. The vulnerability has a CVSS score of 6.9 with public exploit code available, enabling remote compromise of database confidentiality and integrity without authentication or user interaction. The vendor has not responded to early disclosure notification.

Technical ContextAI

The vulnerability exists in the yudao-cloud application framework, specifically in the tenant management API endpoint /admin-api/system/tenant/get-by-website. The root cause is classified as CWE-89 (SQL Injection), stemming from insufficient input validation or parameterization of the Website parameter before it is incorporated into a SQL query. The affected product (cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:*) is an open-source cloud architecture framework. The flaw allows an attacker to manipulate SQL query logic by injecting malicious SQL syntax into the Website input field, potentially bypassing authentication and authorization checks within the application's database layer.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor has not responded to early disclosure notifications. Immediate mitigation options include: (1) Upgrade to a patched version if released post-2026.01 (recommended once available); (2) Implement network-level access controls to restrict access to the /admin-api/system/tenant/get-by-website endpoint to trusted internal networks only; (3) Deploy a Web Application Firewall (WAF) with SQL injection detection rules to monitor and block malicious queries targeting the Website parameter; (4) Consider temporarily disabling the tenant management API endpoint if operationally feasible. Monitor VulDB (https://vuldb.com/vuln/354181) and the vendor's GitHub repository for patch announcements. Given vendor non-responsiveness, communities may provide security patches or forks-evaluate carefully before adopting.