Aibot888

A flaw exists in YunaiV yudao-cloud that could lead to improper authorization. This issue is related to the HTTP Request Handler component and the `/crm/contact/transfer` file. The `contactId` argument can be manipulated to trigger the issue. The exploit has been publicly disclosed. The vendor was notified but did not respond.

A security flaw exists in yangzongzhuan RuoYi. The issue involves improper authorization due to manipulation of the `userIds` argument in the file '/system/role/authUser/selectAll'. This allows for remote exploitation. The exploit has been publicly released. The vendor was notified but did not respond.

A flaw exists in YunaiV ruoyi-vue-pro up to version 2025.09, related to improper authorization. The issue is located in an unspecified part of the `/crm/business/transfer` file and can be exploited remotely. The exploit is publicly available. The vendor was notified but did not respond.

An issue exists in roncoo-pay where manipulation of an unknown function within the `/user/info/lookupList` file can lead to improper authorization. This issue can be exploited remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Name of the Vulnerable Software and Affected Versions: YunaiV ruoyi-vue-pro versions prior to 2025.09 Description: A flaw exists in YunaiV ruoyi-vue-pro that allows for improper authorization. The issue is related to the manipulation of the `ids`/`newOwnerUserId` argument within an unknown function of the file `/crm/contact/transfer`. This manipulation can be performed remotely. The exploit has been published. Recommendations: Update YunaiV ruoyi-vue-pro to version 2025.09 or later. As a temporary workaround, restrict access to the `/crm/contact/transfer` file. Avoid using the `ids` and `newOwnerUserId` arguments in the `/crm/contact/transfer` endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: linlinjava litemall versions up to 1.8.0 Description: A weakness exists in linlinjava litemall up to version 1.8.0. The issue affects the `WxAftersaleController` function within the `/wx/aftersale/cancel` file. Manipulation of the `ID` argument can lead to improper authorization. This issue can be exploited remotely. The exploit has been made publicly available. The vendor was contacted but did not respond. Recommendations: Versions prior to 1.8.0 should be used. As a temporary workaround, restrict access to the `/wx/aftersale/cancel` file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: JeecgBoot versions prior to 3.8.2 Description: A vulnerability exists in JeecgBoot related to improper authorization within the WebSocket Message Handler component. The issue is associated with the `/api/system/sendWebSocketMsg` API endpoint and the manipulation of the `userIds` parameter. This allows for remote exploitation. The vendor was contacted regarding this disclosure but did not respond. The exploit is publicly available. Recommendations: Update JeecgBoot to a version later than 3.8.2. Restrict access to the `/api/system/sendWebSocketMsg` API endpoint. Avoid using the `userIds` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: iteachyou Dreamer CMS versions through 4.1.3.2 Description: A weakness exists in iteachyou Dreamer CMS related to weak password requirements during some unknown processing of the file `/admin/user/updatePwd`. Remote exploitation is possible, but requires a high degree of complexity and is assessed as difficult. The exploit is publicly available. The vendor was contacted regarding this issue but did not respond. Recommendations: Update iteachyou Dreamer CMS to a version beyond 4.1.3.2.

Name of the Vulnerable Software and Affected Versions: roncoo-pay versions prior to 9428382af21cd5568319eae7429b7e1d0332ff40 Description: A vulnerability exists in roncoo-pay that allows for direct request manipulation. The issue is related to the `/auth/orderQuery` file and an unknown function within it. Exploitation involves manipulating the `orderNo` argument. The attack can be performed remotely and is considered difficult to exploit. The exploit has been publicly disclosed. Recommendations: Update roncoo-pay to a version prior to 9428382af21cd5568319eae7429b7e1d0332ff40.

Name of the Vulnerable Software and Affected Versions: YunaiV yudao-cloud versions prior to 2025.09 Description: A weakness exists in YunaiV yudao-cloud that may lead to improper authorization. The issue affects an unknown part of the file `/crm/business/transfer`. Manipulation of the argument `ids/newOwnerUserId` can be exploited remotely. The exploit has been made publicly available. The vendor was contacted but did not respond. Recommendations: Versions prior to 2025.09: Address improper authorization by carefully reviewing and securing the `/crm/business/transfer` file and the `ids/newOwnerUserId` argument.

Improper authorization occurs in the '/crm/contract/transfer' file due to the manipulation of the `id` and `newOwnerUserId` arguments. This allows for remote exploitation of the system.

Name of the Vulnerable Software and Affected Versions: YunaiV yudao-cloud versions prior to 2025.09 Description: A vulnerability exists in YunaiV yudao-cloud that affects processing of the file `/crm/receivable/submit`. Manipulation of the `ID` argument results in improper authorization, and the attack can be executed remotely. The exploit is publicly available. The vendor was contacted but did not respond. Recommendations: Versions prior to 2025.09: Address improper authorization related to the manipulation of the `ID` argument in the `/crm/receivable/submit` file processing.

A security flaw exists in the `deleteFile` function of the `LocalStorageController` component, resulting in improper authorization. The issue is remotely exploitable and has been publicly disclosed.

A vulnerability exists in the AdController function of the /ad/queryAll file, leading to improper authorization. The issue is remotely exploitable and the exploit is publicly available.

A critical issue has been identified in Onyx, potentially allowing for SQL injection. This occurs through manipulation of the `generate simple sql` function within the `backend/onyx/agents/agent search/kb search/nodes/a3 generate simple sql.py` file of the Chat Interface component. The attack can be initiated remotely. The exploit has been publicly disclosed.

Name of the Vulnerable Software and Affected Versions: hitzs-ids airda version 0.0.3 Description: A critical vulnerability exists in the `execute` function of the `/v1/chat/completions` file. Manipulation of the `question` argument results in SQL injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Recommendations: For hitsz-ids airda version 0.0.3, avoid using the `question` parameter in the `/v1/chat/completions` API endpoint until the issue is resolved.