# cve.now: Yonyou

The newest entries naming Yonyou as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2023-54403](https://cve.now/CVE-2023-54403.md): Yonyou U8 CRM Arbitrary File Read via getemaildata.php (CVSS 8.7)
- [CVE-2015-20122](https://cve.now/CVE-2015-20122.md): Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp (CVSS 8.7)
- [CVE-2026-94492](https://cve.now/CVE-2026-94492.md): Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection (CVSS 5.3)
- [CVE-2026-94491](https://cve.now/CVE-2026-94491.md): Yonyou KSOA search\_list.jsp sql injection (CVSS 6.9)
- [CVE-2024-58385](https://cve.now/CVE-2024-58385.md): Yonyou U8 CRM SQL Injection via fillbacksettingedit.php (CVSS 9.3)
- [CVE-2023-54398](https://cve.now/CVE-2023-54398.md): Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet (CVSS 9.3)
- [CVE-2026-1179](https://cve.now/CVE-2026-1179.md): Yonyou KSOA HTTP GET Parameter user\_popedom.jsp sql injection (CVSS 6.9)
- [CVE-2026-1178](https://cve.now/CVE-2026-1178.md): Yonyou KSOA HTTP GET Parameter select.jsp sql injection (CVSS 6.9)
- [CVE-2026-1177](https://cve.now/CVE-2026-1177.md): Yonyou KSOA HTTP GET Parameter save\_folder.jsp sql injection (CVSS 6.9)
- [CVE-2026-1133](https://cve.now/CVE-2026-1133.md): Yonyou KSOA HTTP GET Parameter folder.jsp sql injection (CVSS 6.9)
- [CVE-2026-1132](https://cve.now/CVE-2026-1132.md): Yonyou KSOA HTTP GET Parameter edit\_folder.jsp sql injection (CVSS 6.9)
- [CVE-2026-1131](https://cve.now/CVE-2026-1131.md): Yonyou KSOA HTTP GET Parameter save\_catalog.jsp sql injection (CVSS 6.9)
- [CVE-2026-1130](https://cve.now/CVE-2026-1130.md): Yonyou KSOA HTTP GET Parameter worksadd\_plan.jsp sql injection (CVSS 6.9)
- [CVE-2026-1129](https://cve.now/CVE-2026-1129.md): Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injection (CVSS 6.9)
- [CVE-2026-1124](https://cve.now/CVE-2026-1124.md): Yonyou KSOA HTTP GET Parameter work\_report.jsp sql injection (CVSS 6.9)
- [CVE-2026-1123](https://cve.now/CVE-2026-1123.md): Yonyou KSOA HTTP GET Parameter work\_mod.jsp sql injection (CVSS 6.9)
- [CVE-2026-1122](https://cve.now/CVE-2026-1122.md): Yonyou KSOA HTTP GET Parameter work\_info.jsp sql injection (CVSS 6.9)
- [CVE-2026-1121](https://cve.now/CVE-2026-1121.md): Yonyou KSOA HTTP GET Parameter del\_workplan.jsp sql injection (CVSS 6.9)
- [CVE-2026-1120](https://cve.now/CVE-2026-1120.md): Yonyou KSOA HTTP GET Parameter del\_work.jsp sql injection (CVSS 6.9)
- [CVE-2025-15436](https://cve.now/CVE-2025-15436.md): Yonyou KSOA work\_edit.jsp sql injection (CVSS 6.9)
- [CVE-2025-15435](https://cve.now/CVE-2025-15435.md): Yonyou KSOA work\_update.jsp sql injection (CVSS 6.9)
- [CVE-2025-15434](https://cve.now/CVE-2025-15434.md): Yonyou KSOA PrintZPYG.jsp sql injection (CVSS 6.9)
- [CVE-2025-15425](https://cve.now/CVE-2025-15425.md): Yonyou KSOA HTTP GET Parameter del\_user.jsp sql injection (CVSS 6.9)
- [CVE-2025-15424](https://cve.now/CVE-2025-15424.md): Yonyou KSOA HTTP GET Parameter agent\_worksdel.jsp sql injection (CVSS 6.9)
- [CVE-2025-15421](https://cve.now/CVE-2025-15421.md): Yonyou KSOA HTTP GET Parameter agent\_worksadd.jsp sql injection (CVSS 6.9)
- [CVE-2025-15420](https://cve.now/CVE-2025-15420.md): Yonyou KSOA agent\_work\_report.jsp sql injection (CVSS 6.9)
- [CVE-2025-14185](https://cve.now/CVE-2025-14185.md): Yonyou U8 Cloud AppServletService.class sql injection (CVSS 5.3)
- [CVE-2025-12344](https://cve.now/CVE-2025-12344.md): Yonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted upload (CVSS 5.3)
- [CVE-2025-34039](https://cve.now/CVE-2025-34039.md): Yonyou NC BeanShell Command Injection (CVSS 10.0)
- [CVE-2025-3562](https://cve.now/CVE-2025-3562.md): Yonyou YonBIP userfile FileInputStream path traversal (CVSS 5.3)
- [CVE-2025-2712](https://cve.now/CVE-2025-2712.md): Yonyou UFIDA ERP-NC top.jsp cross site scripting (CVSS 5.3)
- [CVE-2025-2711](https://cve.now/CVE-2025-2711.md): Yonyou UFIDA ERP-NC systop.jsp cross site scripting (CVSS 5.3)
- [CVE-2025-2710](https://cve.now/CVE-2025-2710.md): Yonyou UFIDA ERP-NC menu.jsp cross site scripting (CVSS 5.3)
- [CVE-2025-2709](https://cve.now/CVE-2025-2709.md): Yonyou UFIDA ERP-NC login.jsp cross site scripting (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/yonyou
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.