CVE-2025-14185: Yonyou U8 Cloud AppServletService.class sql injection
A vulnerability was identified in Yonyou U8 Cloud 5.0/5.0sp/5.1/5.1sp. The affected element is an unknown function of the file nc/pubitf/erm/mobile/appservice/AppServletService.class. Such manipulation of the argument usercode leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14185?
CVE-2025-14185 is a critical severity vulnerability due to its potential for remote SQL injection.
How do I fix CVE-2025-14185?
To fix CVE-2025-14185, update the Yonyou U8 Cloud software to the latest version that addresses this vulnerability.
What software is affected by CVE-2025-14185?
CVE-2025-14185 affects Yonyou U8 Cloud versions between 5.0 and 5.1sp.
What type of vulnerability is CVE-2025-14185?
CVE-2025-14185 is categorized as an SQL injection vulnerability.
How can attackers exploit CVE-2025-14185?
Attackers can exploit CVE-2025-14185 by manipulating the 'usercode' argument in the affected AppServletService.class.