{"id":"CVE-2026-7678","aliases":[],"title":"YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection","titleSource":"VulDB","descriptionSource":"VulDB","products":[{"vendor":"YunaiV","name":"yudao-cloud","platforms":[],"versions":[{"version":"2026.01","status":"affected"}],"source":"VulDB","url":"https://www.cve.org/CVERecord?id=CVE-2026-7678"}],"remediation":[],"description":"A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor explains: \"[T]he SQL execution feature and existing report:go-view-data:get-by-sql functional permission remain. We are not adding a super-administrator restriction, default-off switch or independent-datasource enforcement in this batch. SQL access granted through that permission must be limited to trusted roles and appropriate database privileges; this item is not reported as patched.\"","severity":"medium","score":5.3,"published":"2026-05-03T04:00:14.024Z","modified":"2026-10-27T07:21:43.643Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://vuldb.com/vuln/360831","https://vuldb.com/vuln/360831/cti","https://vuldb.com/cve/CVE-2026-7678","https://vuldb.com/submit/800865","https://github.com/9str0IL/CVE/issues/2"],"sources":[{"name":"CVE","id":"CVE-2026-7678","modified":"2026-10-27T07:21:43.643Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-7678"}],"assessments":[{"source":"VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","score":5.3},{"source":"VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","score":6.3},{"source":"VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","score":6.3},{"source":"VulDB","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","score":6.5}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:25:32.580Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}