CVE-2026-7678

YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection

CVSS 5.3 MEDIUMEPSS 0.2%CWE-74 CWE-89

A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

YunaiV · yudao-cloud

public PoCs found — 1

cve_referencegithub.com/9str0IL/CVE/issues/2unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/9str0IL/CVE/issues/2 https://vuldb.com/submit/800865 https://vuldb.com/vuln/360831 https://vuldb.com/vuln/360831/cti