{"id":"CVE-2026-7678","title":"YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection","summary":"A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulatio…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","cvssSource":"cna","cwe":["CWE-89","CWE-74"],"vendor":"YunaiV","product":"yudao-cloud","affected":["yudao-cloud 2026.01"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-05-04T16:20:55.412234Z"},"exploitAvailable":true,"published":"2026-05-03","updated":"2026-10-27","sourceUpdated":"2026-10-27T07:21:43.643Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-7678","references":[{"url":"https://vuldb.com/vuln/360831","label":"VDB-360831 | YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection"},{"url":"https://vuldb.com/vuln/360831/cti","label":"VDB-360831 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-7678","label":"CVE-2026-7678 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/800865","label":"Submit #800865 | YunaiV yudao-cloud yudao-cloud up to 2026.01 SQL Injection"},{"url":"https://github.com/9str0IL/CVE/issues/2"}],"tags":["cve.org","exploit-available"],"epss":0.00228,"epssPercentile":0.1352,"ingestedAt":"2026-10-27T16:11:59.240Z","slug":"CVE-2026-7678","body":"## Overview\n\nA vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: \"[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched.\"\n\n## Affected\n\n- `yudao-cloud 2026.01`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}