YYunaiV

Products

Exploited and recent CVEs

• CVE-2026-116007 Low 3.7 YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication 0.4%
• CVE-2026-116006 High 7.3 YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication 0.8%
• CVE-2026-116016 High 7.1 yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header 0.3%
• CVE-2026-116015 Medium 4.3 yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint 0.2%
• CVE-2026-110610 Medium 5.4 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl 0.3%
• CVE-2026-97325 Medium 4.3 YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect 0.3%
• CVE-2026-97324 High 7.3 YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization 0.3%
• CVE-2026-97323 Medium 6.3 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal 0.4%
• CVE-2026-97322 Medium 4.3 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting 0.3%
• CVE-2026-97321 Medium 6.3 YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection 0.2%
• CVE-2026-97320 Medium 6.3 YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery 0.3%
• CVE-2026-58448 Medium 6.5 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API 0.4%
• CVE-2026-13528 High 7.3 YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal 0.6%
• CVE-2026-9464 Medium 4.7 YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery 0.4%
• CVE-2026-7710 High 7.3 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication 0.4%
• CVE-2026-7679 High 7.3 YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication 0.4%
• CVE-2026-7678 Medium 6.3 YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection 0.2%
• CVE-2026-5148 Medium 4.7 YunaiV yudao-cloud page sql injection 0.3%
• CVE-2026-5147 High 7.3 YunaiV yudao-cloud get-by-website sql injection 0.3%
• CVE-2025-15098 Medium 6.3 YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery 0.3%
• CVE-2025-10988 Medium 6.3 YunaiV ruoyi-vue-pro transfer improper authorization 0.3%
• CVE-2025-10987 Medium 6.3 YunaiV yudao-cloud HTTP Request transfer improper authorization 0.3%
• CVE-2025-10278 Medium 6.3 YunaiV ruoyi-vue-pro transfer improper authorization 0.3%
• CVE-2025-10277 Medium 6.3 YunaiV yudao-cloud submit improper authorization 0.3%
• CVE-2025-10276 Medium 6.3 YunaiV ruoyi-vue-pro transfer improper authorization 0.3%
• CVE-2025-10275 Medium 6.3 YunaiV yudao-cloud transfer improper authorization 0.3%