Yonyou vendor intelligence
Yonyou Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Yonyou products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 6
- Known exploited vulnerabilities affecting Yonyou products
- In CISA KEV
- 0
- Records also listed in the official catalog
- Beyond CISA KEV
- 6
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 0
- Yonyou KEVs with sensor-observed exploitation activity
The catalog gap matters for Yonyou exposure
All six exploited Yonyou vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss 100% of this vendor portfolio.
- 0%
- Covered by CISA
- 100%
- Beyond CISA
- 5
- Product families
Attested Yonyou vulnerabilities
6 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2023-54403
Yonyou U8 CRM Arbitrary File Read via getemaildata.php |
U8 CRM | High | Beyond CISA | 30 Sep 2026 |
|
CVE-2015-20122
Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp |
A6 OA | High | Beyond CISA | 29 Sep 2026 |
|
CVE-2024-58385
Yonyou U8 CRM SQL Injection via fillbacksettingedit.php |
U8 CRM | High | Beyond CISA | 15 Sep 2026 |
|
CVE-2023-54398
Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet |
U8 Cloud | High | Beyond CISA | 15 Sep 2026 |
|
CVE-2022-50973
Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet |
KSOA | High | Beyond CISA | 17 Aug 2026 |
|
CVE-2025-34039
Yonyou NC BeanShell Command Injection |
UFIDA NC | High | Beyond CISA | 12 Jan 2026 |
No Yonyou vulnerabilities match this search or filter.
Showing 6 of 6 on this page (6 Yonyou known exploited vulnerabilities).
Recurring weakness patterns
Neutralization, limitation, and missing authentication for critical function account for four mapped occurrences across this Yonyou KEV portfolio.
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-306
Missing Authentication for Critical Function
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-502
Deserialization of Untrusted Data