Yunaiv
Monthly
Row-level data-scope enforcement in yudao-cloud through 2026.09 can be switched off by any authenticated tenant user who sends a 'data-permission-enable: false' header on requests to /admin-api (and /app-api), letting them read or modify records belonging to other departments and users inside the same tenant. The flaw is a trust-boundary error (CWE-807): DataPermissionRpcWebFilter honours that header on every request path instead of only on internal /rpc-api calls, so no special configuration, user interaction, or elevated role is needed beyond a valid account. Rated High at CVSS 4.0 7.1 (assessed 3.1: AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:N); no public exploit code was identified at time of analysis, though a third-party technical writeup of the header bypass is referenced, and the vendor has published an upstream fix commit.
Information disclosure in the yudao-cloud BPM (business process management) module before 2026.06 lets any authenticated user read arbitrary workflow process-instance records by passing a caller-controlled process-instance ID to a GET endpoint that lacks the @PreAuthorize authorization check. Exposed data includes submitted form variables, approver identities, approval/rejection comments, and raw BPMN XML, with no ownership or tenant validation enforced. Publicly available exploit code exists and a vendor patch is available; the issue is not listed in CISA KEV.
Missing attempt throttling in the SMS code verification logic of ruoyi-vue-pro (through version 2026.09) allows unauthenticated remote attackers to repeatedly submit verification-code guesses for a known phone number, with the only real impact being low confidentiality exposure if a guess lands inside the code's validity window. Attack complexity is rated high and exploitability 'difficult', and the CVSS 4.0 base score is 2.9 (LOW) with a vuln.today decision label of 'monitor'; a public PoC reference exists but is not verified as working exploit code, no CISA KEV entry applies, and the vendor did not respond to the disclosure so no fixed release is confirmed.
Improper authentication in the SMS code verification flow of ruoyi-vue-pro (AuthController.java) lets remote attackers manipulate the 'mobile' and 'code' parameters to subvert login verification, yielding limited confidentiality, integrity and availability impact rather than full account takeover evidence. Versions up to and including 2026.09 are reported affected; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the independent assessment both confirm the attack is network-reachable with no privileges or user interaction, though the SMS login feature must be enabled and exposed for exploitation. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the item is triaged as 'this_month' priority - a genuine but moderate-priority issue rather than a top-tier emergency.
Authenticated members of Yudao Cloud (yudao-cloud) through 2026.09 can read other members' after-sale operation logs through an insecure direct object reference in the mall trade module, exposing refund amounts, status transitions and timestamps. The endpoint GET /app-api/trade/after-sale-log/list accepts arbitrary, sequentially enumerable afterSaleId values without an ownership check, giving a read-only confidentiality impact rated CVSS 5.3 (PR:L). No CISA KEV entry or confirmed active exploitation is indicated; a public technical writeup reference exists but is not verified as working exploit code, and the vendor has published a fix commit.
Server-side request forgery in the yudao-module-ai image service of ruoyi-vue-pro (through 2026.09) lets an authenticated user make the application server issue HTTP requests to arbitrary destinations by supplying the referImageUrl parameter to the Midjourney 'imagine' endpoint, which is handed to Hutool's HttpUtil.downloadBytes() without SSRF filtering. Exploitation requires a valid low-privileged application account with access to that AI image feature (CVSS 4.0 base 5.3, PR:L), so there is no unauthenticated attack path; the practical payoff is internal reconnaissance and information disclosure - probing loopback, RFC1918, and cloud metadata endpoints such as 169.254.169.254 - rather than code execution. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate-priority finding whose real-world severity rises sharply on cloud-hosted deployments that expose IMDSv1 or internal-only administrative services.
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Path traversal in the ruoyi-vue-pro file upload endpoint exposes unauthenticated remote attackers to arbitrary file read and write operations via the `generateUploadPath` function in `FileServiceImpl.java`. All versions up to 2026.04-jdk8-SNAPSHOT are confirmed affected across both the YunaiV (GitHub) and zhijiantianya (Gitee) vendor distributions. Publicly available exploit code exists via GitHub issue #1146; no CISA KEV listing is present, but the unauthenticated network vector combined with a public proof-of-concept materially elevates operational risk above the CVSS 4.0 base score of 6.9 alone.
Server-side request forgery in YunaiV yudao-cloud 2026.03 allows authenticated administrators to force the server to issue arbitrary HTTP requests via the IoT data sink creation endpoint. The vulnerability exists in the IotDataSinkHttpConfig function exposed at /admin-api/iot/data-sink/create, where attacker-controlled URL parameters are passed to an outbound HTTP client without adequate validation. A proof-of-concept exploit has been publicly disclosed on GitHub; however, the CVSS 4.0 base score of 2.0 and a 0.03% EPSS probability reflect the significant limiting factor of requiring high-privilege authentication, and no KEV listing indicates no confirmed active exploitation at time of analysis.
Authentication bypass in YunaiV yudao-cloud (versions up to 2026.01) allows remote unauthenticated attackers to obtain unauthorized access tokens via manipulation of the getAccessToken function in OAuth2TokenServiceImpl.java. Public exploit code exists (GitHub PoC available), enabling attackers to bypass authentication controls and gain low-level access to confidential data, integrity, and availability. EPSS risk assessment unavailable, but the combination of network attack vector, low complexity (AC:L), no authentication requirement (PR:N), and publicly available exploit creates immediate exploitation risk. Vendor was notified but did not respond, leaving no official patch timeline.
SQL injection in YunaiV yudao-cloud up to version 2026.01 allows authenticated remote attackers to execute arbitrary SQL queries via the getDataBySQL function in GoViewDataServiceImpl.java, potentially compromising confidentiality, integrity, and availability of the application database. Publicly available exploit code exists, and the vendor did not respond to early disclosure notifications.
Remote SQL injection in YunaiV yudao-cloud up to version 2026.01 allows unauthenticated attackers to execute arbitrary SQL queries via the Website parameter in the /admin-api/system/tenant/get-by-website endpoint. The vulnerability has a CVSS score of 6.9 with public exploit code available, enabling remote compromise of database confidentiality and integrity without authentication or user interaction. The vendor has not responded to early disclosure notification.
Row-level data-scope enforcement in yudao-cloud through 2026.09 can be switched off by any authenticated tenant user who sends a 'data-permission-enable: false' header on requests to /admin-api (and /app-api), letting them read or modify records belonging to other departments and users inside the same tenant. The flaw is a trust-boundary error (CWE-807): DataPermissionRpcWebFilter honours that header on every request path instead of only on internal /rpc-api calls, so no special configuration, user interaction, or elevated role is needed beyond a valid account. Rated High at CVSS 4.0 7.1 (assessed 3.1: AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:N); no public exploit code was identified at time of analysis, though a third-party technical writeup of the header bypass is referenced, and the vendor has published an upstream fix commit.
Information disclosure in the yudao-cloud BPM (business process management) module before 2026.06 lets any authenticated user read arbitrary workflow process-instance records by passing a caller-controlled process-instance ID to a GET endpoint that lacks the @PreAuthorize authorization check. Exposed data includes submitted form variables, approver identities, approval/rejection comments, and raw BPMN XML, with no ownership or tenant validation enforced. Publicly available exploit code exists and a vendor patch is available; the issue is not listed in CISA KEV.
Missing attempt throttling in the SMS code verification logic of ruoyi-vue-pro (through version 2026.09) allows unauthenticated remote attackers to repeatedly submit verification-code guesses for a known phone number, with the only real impact being low confidentiality exposure if a guess lands inside the code's validity window. Attack complexity is rated high and exploitability 'difficult', and the CVSS 4.0 base score is 2.9 (LOW) with a vuln.today decision label of 'monitor'; a public PoC reference exists but is not verified as working exploit code, no CISA KEV entry applies, and the vendor did not respond to the disclosure so no fixed release is confirmed.
Improper authentication in the SMS code verification flow of ruoyi-vue-pro (AuthController.java) lets remote attackers manipulate the 'mobile' and 'code' parameters to subvert login verification, yielding limited confidentiality, integrity and availability impact rather than full account takeover evidence. Versions up to and including 2026.09 are reported affected; the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the independent assessment both confirm the attack is network-reachable with no privileges or user interaction, though the SMS login feature must be enabled and exposed for exploitation. A public PoC reference exists; it is not verified as working exploit code, there is no CISA KEV entry, and the item is triaged as 'this_month' priority - a genuine but moderate-priority issue rather than a top-tier emergency.
Authenticated members of Yudao Cloud (yudao-cloud) through 2026.09 can read other members' after-sale operation logs through an insecure direct object reference in the mall trade module, exposing refund amounts, status transitions and timestamps. The endpoint GET /app-api/trade/after-sale-log/list accepts arbitrary, sequentially enumerable afterSaleId values without an ownership check, giving a read-only confidentiality impact rated CVSS 5.3 (PR:L). No CISA KEV entry or confirmed active exploitation is indicated; a public technical writeup reference exists but is not verified as working exploit code, and the vendor has published a fix commit.
Server-side request forgery in the yudao-module-ai image service of ruoyi-vue-pro (through 2026.09) lets an authenticated user make the application server issue HTTP requests to arbitrary destinations by supplying the referImageUrl parameter to the Midjourney 'imagine' endpoint, which is handed to Hutool's HttpUtil.downloadBytes() without SSRF filtering. Exploitation requires a valid low-privileged application account with access to that AI image feature (CVSS 4.0 base 5.3, PR:L), so there is no unauthenticated attack path; the practical payoff is internal reconnaissance and information disclosure - probing loopback, RFC1918, and cloud metadata endpoints such as 169.254.169.254 - rather than code execution. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate-priority finding whose real-world severity rises sharply on cloud-hosted deployments that expose IMDSv1 or internal-only administrative services.
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Path traversal in the ruoyi-vue-pro file upload endpoint exposes unauthenticated remote attackers to arbitrary file read and write operations via the `generateUploadPath` function in `FileServiceImpl.java`. All versions up to 2026.04-jdk8-SNAPSHOT are confirmed affected across both the YunaiV (GitHub) and zhijiantianya (Gitee) vendor distributions. Publicly available exploit code exists via GitHub issue #1146; no CISA KEV listing is present, but the unauthenticated network vector combined with a public proof-of-concept materially elevates operational risk above the CVSS 4.0 base score of 6.9 alone.
Server-side request forgery in YunaiV yudao-cloud 2026.03 allows authenticated administrators to force the server to issue arbitrary HTTP requests via the IoT data sink creation endpoint. The vulnerability exists in the IotDataSinkHttpConfig function exposed at /admin-api/iot/data-sink/create, where attacker-controlled URL parameters are passed to an outbound HTTP client without adequate validation. A proof-of-concept exploit has been publicly disclosed on GitHub; however, the CVSS 4.0 base score of 2.0 and a 0.03% EPSS probability reflect the significant limiting factor of requiring high-privilege authentication, and no KEV listing indicates no confirmed active exploitation at time of analysis.
Authentication bypass in YunaiV yudao-cloud (versions up to 2026.01) allows remote unauthenticated attackers to obtain unauthorized access tokens via manipulation of the getAccessToken function in OAuth2TokenServiceImpl.java. Public exploit code exists (GitHub PoC available), enabling attackers to bypass authentication controls and gain low-level access to confidential data, integrity, and availability. EPSS risk assessment unavailable, but the combination of network attack vector, low complexity (AC:L), no authentication requirement (PR:N), and publicly available exploit creates immediate exploitation risk. Vendor was notified but did not respond, leaving no official patch timeline.
SQL injection in YunaiV yudao-cloud up to version 2026.01 allows authenticated remote attackers to execute arbitrary SQL queries via the getDataBySQL function in GoViewDataServiceImpl.java, potentially compromising confidentiality, integrity, and availability of the application database. Publicly available exploit code exists, and the vendor did not respond to early disclosure notifications.
Remote SQL injection in YunaiV yudao-cloud up to version 2026.01 allows unauthenticated attackers to execute arbitrary SQL queries via the Website parameter in the /admin-api/system/tenant/get-by-website endpoint. The vulnerability has a CVSS score of 6.9 with public exploit code available, enabling remote compromise of database confidentiality and integrity without authentication or user interaction. The vendor has not responded to early disclosure notification.