Vendor
high
threat
Arbitrary File Read in Yonyou U8 CRM
2 TTPs 1 CVEAn unauthenticated arbitrary file read vulnerability (CVE-2023-54403) in Yonyou U8 CRM allows attackers to bypass authentication and access sensitive files on the host server.
exploited
U8 CRM
cve-2023-54403
arbitrary-file-read
yonyou
2t
1c
high
advisory
CVE-2026-94491 SQL Injection in Yonyou KSOA
1 rule 1 TTP 1 CVEYonyou KSOA 9.0 is vulnerable to unauthenticated remote SQL injection via the address argument in the /cardcase/search_list.jsp endpoint.
KSOA
sql-injection
web-application
vulnerability
1r
1t
1c
critical
threat
Unauthenticated SQL Injection in Yonyou U8 CRM (CVE-2024-58385)
1 rule 2 TTPs 1 CVEAn unauthenticated SQL injection vulnerability in Yonyou U8 CRM allows attackers to execute arbitrary SQL commands via the fillbacksettingedit.php endpoint, potentially leading to remote code execution on MS SQL Server instances.
exploited
U8 CRM
web-application
sql-injection
remote-code-execution
cve-2024-58385
1r
2t
1c
critical
threat
Unauthenticated RCE in Yonyou U8 Cloud via Java Deserialization
1 rule 2 TTPs 1 CVEYonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability (CVE-2023-54398) in the FileManageServlet component, enabling remote attackers to achieve arbitrary OS command execution.
exploited
U8 Cloud
1r
2t
1c