Skip to contentYunaiv Yudao-cloud vulnerabilities
- yunaiv yudao-cloudyudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable HeaderCVE-2026-1160167.1 High
- yunaiv yudao-cloudyudao-cloud through 2026.09 IDOR via after-sale-log list endpointCVE-2026-1160155.3 Medium
- yunaiv yudao-cloudyudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance APICVE-2026-584487.1 High
- yunaiv yudao-cloudYunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgeryCVE-2026-94645.1 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authenticationCVE-2026-77106.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authenticationCVE-2026-76796.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injectionCVE-2026-76785.3 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud page sql injectionCVE-2026-51485.1 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud get-by-website sql injectionCVE-2026-5147Public exploit6.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgeryCVE-2025-150985.3 Medium
- iocoder yudao-cloudYunaiV yudao-cloud HTTP Request transfer improper authorizationCVE-2025-109875.3 Medium
- iocoder yudao-cloudYunaiV yudao-cloud submit improper authorizationCVE-2025-102775.3 Medium
- iocoder yudao-cloudYunaiV yudao-cloud transfer improper authorizationCVE-2025-102755.3 Medium