Yonyou
- Total products in the ecosystem
- 5
- Total vulnerabilities (90 days)
- 2
en
Verify to analyze this security profile
As of 09/18/2026, Yonyou recorded 2 security vulnerabilities in the last 90 days across 2 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, U8 Cloud had the most security vulnerabilities in the Yonyou ecosystem, with 1 vulnerabilities—approximately 50% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2024-58385Yonyou U8 CRM SQL Injection via fillbacksettingedit.php | Exploitation statusPublic exploit | FixYes | Affected productU8 CRM | Published09/15/2026 | SeverityCritical |
CVE-2023-54398Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet | Exploitation statusPublic exploit | FixYes | Affected productU8 Cloud | Published09/15/2026 | SeverityCritical |
CVE-2026-1179Yonyou KSOA HTTP GET Parameter user_popedom.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1178Yonyou KSOA HTTP GET Parameter select.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1177Yonyou KSOA HTTP GET Parameter save_folder.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1133Yonyou KSOA HTTP GET Parameter folder.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1132Yonyou KSOA HTTP GET Parameter edit_folder.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1131Yonyou KSOA HTTP GET Parameter save_catalog.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1130Yonyou KSOA HTTP GET Parameter worksadd_plan.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1129Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/19/2026 | SeverityMedium |
CVE-2026-1124Yonyou KSOA HTTP GET Parameter work_report.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/18/2026 | SeverityMedium |
CVE-2026-1123Yonyou KSOA HTTP GET Parameter work_mod.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/18/2026 | SeverityMedium |
CVE-2026-1122Yonyou KSOA HTTP GET Parameter work_info.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/18/2026 | SeverityMedium |
CVE-2026-1121Yonyou KSOA HTTP GET Parameter del_workplan.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/18/2026 | SeverityMedium |
CVE-2026-1120Yonyou KSOA HTTP GET Parameter del_work.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/18/2026 | SeverityMedium |
CVE-2025-15436Yonyou KSOA work_edit.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-15435Yonyou KSOA work_update.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-15434Yonyou KSOA PrintZPYG.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-15425Yonyou KSOA HTTP GET Parameter del_user.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-15424Yonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-15421Yonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-15420Yonyou KSOA agent_work_report.jsp sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productKSOA | Published01/02/2026 | SeverityMedium |
CVE-2025-14185Yonyou U8 Cloud AppServletService.class sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productU8 Cloud | Published12/07/2025 | SeverityMedium |
CVE-2025-12344Yonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productU8 Cloud | Published10/28/2025 | SeverityMedium |
CVE-2025-3562Yonyou YonBIP userfile FileInputStream path traversal | Exploitation statusPublic exploit | FixNot confirmed | Affected productYonBIP | Published04/14/2025 | SeverityMedium |
CVE-2025-2712Yonyou UFIDA ERP-NC top.jsp cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Affected productUFIDA ERP-NC | Published03/24/2025 | SeverityMedium |
CVE-2025-2711Yonyou UFIDA ERP-NC systop.jsp cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Affected productUFIDA ERP-NC | Published03/24/2025 | SeverityMedium |
CVE-2025-2710Yonyou UFIDA ERP-NC menu.jsp cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Affected productUFIDA ERP-NC | Published03/24/2025 | SeverityMedium |
CVE-2025-2709Yonyou UFIDA ERP-NC login.jsp cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Affected productUFIDA ERP-NC | Published03/24/2025 | SeverityMedium |
CVE-2024-24256 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/15/2024 | SeverityMedium |
CVE-2023-51906 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/20/2024 | SeverityCritical |
CVE-2023-51926 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/20/2024 | SeverityHigh |
CVE-2023-51927 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/20/2024 | SeverityCritical |
CVE-2023-51924 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/20/2024 | SeverityCritical |
CVE-2023-51928 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/20/2024 | SeverityCritical |
CVE-2023-51925 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/20/2024 | SeverityCritical |
CVE-2023-4748Yongyou UFIDA-NC PrintTemplateFileServlet.java path traversal | Exploitation statusPublic exploit | FixNot confirmed | Affected productUFIDA-NC | Published09/05/2023 | SeverityMedium |
CVE-2022-26263 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/25/2022 | SeverityUnknown |
CVE-2021-41746 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/29/2021 | SeverityUnknown |
CVE-2021-41744 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/22/2021 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan