Yunai

A security flaw has been discovered in YunaiV yudao-cloud. The issue affects an unknown part of the file `/admin-api/system/tenant/get-by-website`. Manipulation of the `Website` argument results in SQL injection. The attack can be launched remotely. The exploit has been publicly released. The vendor was contacted about this disclosure but did not respond.

Name of the Vulnerable Software and Affected Versions: YunaiV yudao-cloud versions prior to 2025.09 Description: A vulnerability exists in YunaiV yudao-cloud that affects processing of the file `/crm/receivable/submit`. Manipulation of the `ID` argument results in improper authorization, and the attack can be executed remotely. The exploit is publicly available. The vendor was contacted but did not respond. Recommendations: Versions prior to 2025.09: Address improper authorization related to the manipulation of the `ID` argument in the `/crm/receivable/submit` file processing.

A critical issue has been found in the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the `path` argument leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.

A critical vulnerability was found in the Backend File Upload Interface of zhijiantianya ruoyi-vue-pro. This affects an unknown part of the file "/admin-api/infra/file/upload" and allows for path traversal through the manipulation of the `path` argument. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.