CVE-2026-94491

HIGH 7.3

Yonyou KSOA search_list.jsp sql injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-89 CWE-74
Vendor	yonyou
Product	ksoa
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for yonyou ksoa

Be the first to know when new high vulnerabilities affecting yonyou ksoa are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Yonyou / KSOA

9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/408191 vuldb.com: https://vuldb.com/vuln/408191/cti vuldb.com: https://vuldb.com/cve/CVE-2026-94491 vuldb.com: https://vuldb.com/submit/895364

Credits

🔍 mjh_123 (VulDB User) VulDB CNA Team