CVE-2026-7678

The record

A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: "[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched."

Affected packages

Related vulnerabilities

• CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-74
• CVE-2026-91915 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization… CWE-74
• CVE-2026-89435 The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes &… CWE-74
• CVE-2026-54453 OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing… CWE-74
• CVE-2026-118258 i18next-http-backend is a backend layer for i18next that loads translation resources in… CWE-74
• CVE-2026-103405 An Improper Neutralization of Special Elements in Output Used by a Downstream Component… CWE-74
• CVE-2026-103400 An Improper Neutralization of Special Elements in Output Used by a Downstream Component… CWE-74
• CVE-2026-106648 The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted… CWE-74