jiefengliang

5 exploits Active since Dec 2025
CVE-2025-15076 WRITEUP HIGH WORKING POC
Tenda CH22 1.0.0.1 - Path Traversal via /public/
A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS 7.3
CVE-2025-15420 WRITEUP HIGH WRITEUP
Yonyou KSOA 9.0 - SQL Injection via worksheetagent_work_report.jsp ID Parameter
A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3
CVE-2025-15421 WRITEUP HIGH WRITEUP
Yonyou KSOA 9.0 - SQL Injection via worksheetagent_worksadd.jsp ID Parameter
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3
CVE-2025-15424 WRITEUP HIGH WRITEUP
Yonyou KSOA 9.0 - SQL Injection via worksheet/agent_worksdel.jsp ID Parameter
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3
CVE-2025-15425 WRITEUP HIGH WRITEUP
Yonyou KSOA 9.0 - SQL Injection via /worksheet/del_user.jsp ID Parameter
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 7.3