Yunaiv vulnerabilities

Products

• Ruoyi-vue-pro 21
• Yudao-cloud 13

Newest

• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication CVE-2026-116007 6.3 MediumOctober 25, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication CVE-2026-116006 6.9 MediumOctober 25, 2026
• yunaiv yudao-cloud yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header CVE-2026-116016 7.1 HighOctober 24, 2026
• yunaiv yudao-cloud yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint CVE-2026-116015 5.3 MediumOctober 24, 2026
• yunaiv ruoyi-vue-pro ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl CVE-2026-110610 5.3 MediumOctober 14, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect CVE-2026-97325 5.3 MediumSeptember 24, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization CVE-2026-97324 6.9 MediumSeptember 24, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal CVE-2026-97323 5.3 MediumSeptember 24, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting CVE-2026-97322 5.3 MediumSeptember 24, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection CVE-2026-97321 5.3 MediumSeptember 24, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery CVE-2026-97320 5.3 MediumSeptember 24, 2026
• yunaiv yudao-cloud yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API CVE-2026-58448 7.1 HighJune 30, 2026
• yunai ruoyi-vue-pro ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController CVE-2026-57950 8.6 HighJune 29, 2026
• yunai ruoyi-vue-pro ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint CVE-2026-57949 7.1 HighJune 29, 2026
• yunaiv ruoyi-vue-pro YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal CVE-2026-13528 6.9 MediumJune 29, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery CVE-2026-9464 5.1 MediumMay 25, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication CVE-2026-7710 6.9 MediumMay 3, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication CVE-2026-7679 6.9 MediumMay 3, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection CVE-2026-7678 5.3 MediumMay 3, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud page sql injection CVE-2026-5148 5.1 MediumMarch 30, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud get-by-website sql injection CVE-2026-5147 Public exploit 6.9 MediumMarch 30, 2026
• yunaiv yudao-cloud YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery CVE-2025-15098 5.3 MediumDecember 26, 2025
• iocoder ruoyi-vue-pro YunaiV ruoyi-vue-pro transfer improper authorization CVE-2025-10988 5.3 MediumSeptember 26, 2025
• iocoder yudao-cloud YunaiV yudao-cloud HTTP Request transfer improper authorization CVE-2025-10987 5.3 MediumSeptember 26, 2025
• iocoder ruoyi-vue-pro YunaiV ruoyi-vue-pro transfer improper authorization CVE-2025-10278 5.3 MediumSeptember 12, 2025
• iocoder yudao-cloud YunaiV yudao-cloud submit improper authorization CVE-2025-10277 5.3 MediumSeptember 12, 2025
• iocoder ruoyi-vue-pro YunaiV ruoyi-vue-pro transfer improper authorization CVE-2025-10276 5.3 MediumSeptember 12, 2025
• iocoder yudao-cloud YunaiV yudao-cloud transfer improper authorization CVE-2025-10275 5.3 MediumSeptember 12, 2025
• iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal CVE-2025-2744 5.3 MediumMarch 25, 2025
• iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal CVE-2025-2743 5.3 MediumMarch 25, 2025
• iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal CVE-2025-2742 5.3 MediumMarch 25, 2025
• iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal CVE-2025-2708 5.3 MediumMarch 24, 2025
• iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal CVE-2025-2707 5.3 MediumMarch 24, 2025
• iocoder ruoyi-vue-pro zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine CVE-2025-2040 5.3 MediumMarch 6, 2025