CVE-2026-94491

17th percentile - higher than 17% of all known CVEs

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Manipulation of the address argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

SQL injection may allow an attacker to read, modify, or delete database data and potentially perform further actions in the system. The public availability of the exploit increases the risk.

Restrict network access to the Yonyou KSOA application and contact the vendor for a fix. Until a patch is available, consider deploying WAF rules filtering traffic to the vulnerable endpoint.