Yunaiv vulnerabilities
26 CVEs and advisories name Yunaiv as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116007YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication
- CVE-2026-116006YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
- CVE-2026-116016yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
- CVE-2026-116015yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
- CVE-2026-110610ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
- CVE-2026-97325YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect
- CVE-2026-97324YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization
- CVE-2026-97323YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal
- CVE-2026-97322YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting
- CVE-2026-97321YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection
- CVE-2026-97320YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery
- CVE-2026-58448yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
- CVE-2026-13528YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal
- CVE-2026-9464YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery
- CVE-2026-7710YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
- CVE-2026-7679YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
- CVE-2026-7678YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
- CVE-2026-5148YunaiV yudao-cloud page sql injection
- CVE-2026-5147YunaiV yudao-cloud get-by-website sql injection
- CVE-2025-15098YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery
- CVE-2025-10988YunaiV ruoyi-vue-pro transfer improper authorization
- CVE-2025-10987YunaiV yudao-cloud HTTP Request transfer improper authorization
- CVE-2025-10278YunaiV ruoyi-vue-pro transfer improper authorization
- CVE-2025-10277YunaiV yudao-cloud submit improper authorization
- CVE-2025-10276YunaiV ruoyi-vue-pro transfer improper authorization
- CVE-2025-10275YunaiV yudao-cloud transfer improper authorization