Vulnerability · Published Mar 30, 2026 · Assigned by VulDB
CVE-2026-5147YunaiV yudao-cloud get-by-website sql injection
High 7.3
In plain English
A high-severity SQL injection in yudao-cloud from YunaiV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| YunaiV | yudao-cloud | 2026.01 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-354181 | YunaiV yudao-cloud get-by-website sql injection vdb-entry, technical-description
- VDB-354181 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-5147 | CVE Analysis and Report third-party-advisory
- Submit #780191 | YunaiV yudao-cloud <=v2026.01 SQL Injection third-party-advisory
- https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/yudaoCloudv2026.01.md related
- https://github.com/NarcherAlter/Security_Note/blob/main/Vulnerability_Discovery/yudaoCloudv2026.01.md#admin-apisystemtenantget-by-website exploit
- https://gitee.com/zhijiantianya/yudao-cloud/commit/bccf7c79e5f93f027a021172a18e8876cc6c1062 patch