CVE-2023-51927

CriticalCVSS 9.8

Published: 20/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

42th percentile - higher than 42% of all known CVEs

Summary

A SQL injection vulnerability was discovered in YonBIP v3_23.05 via the runScript() method of the AttendScriptController. An attacker can exploit this flaw to execute arbitrary SQL queries.

Risk Assessment

The risk includes unauthorized access to sensitive data, modification or deletion of data, potentially leading to a breach of confidentiality and integrity.

Recommendation

Immediately update YonBIP to the latest version and implement parameterized SQL queries in the runScript() method.

Original NVD description (English source)

YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method.