CVE-2026-7678 | BDVDB-2026-330184 Detail

Description#

A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: "[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched."

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-03Record published in the CVE List.
2. Version 22026-10-27Most recent update recorded in the CVE List.