CVE-2025-10277
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
The risk is that a remote attacker can gain unauthorized access to system functions, potentially leading to data integrity breaches or unauthorized operations.
Recommendation
Immediately upgrade yudao-cloud to a patched version if available, and monitor the system for unauthorized activities.
Other vulnerabilities in yudao-cloud
See all- CVE-2026-58448Medium
A broken access control vulnerability in the BPM module of yudao-cloud before version 2026.06 allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected GET endpoint lacking the @PreAuthorize annotation. Attackers can read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.
- CVE-2026-9464Medium
Vulnerability in YunaiV yudao-cloud 2026.03. The IotDataSinkHttpConfig function in /admin-api/iot/data-sink/create of the Admin API Endpoint allows server-side request forgery (SSRF). Remote attack, exploit publicly available.
Original NVD description (English source)
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS