What’s Vulnerable › Vulnerabilities

CVE-2026-7678: YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-03 · updated 2026-10-27
• Weakness: CWE-74

Description

A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: "[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched."

Affected products

• YunaiV yudao-cloud: 2026.01

References

• https://github.com/9str0IL/CVE/issues/2
• https://vuldb.com/cve/CVE-2026-7678
• https://vuldb.com/submit/800865
• https://vuldb.com/vuln/360831
• https://vuldb.com/vuln/360831/cti

Get alerted when CVE-2026-7678 or the next vulnerability affects your stack