CVE-2025-15420: Yonyou KSOA agent_work_report.jsp sql injection

Published Jan 2, 2026

Updated

A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agentworkreport.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 2, 2026

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-15420?

CVE-2025-15420 has been classified with a high severity due to its potential for remote SQL injection.

How do I fix CVE-2025-15420?

To fix CVE-2025-15420, validate and sanitize user inputs to prevent SQL injection in the affected file.

What are the potential impacts of CVE-2025-15420?

The potential impacts of CVE-2025-15420 include unauthorized access to sensitive data and manipulation of the database.

Who is affected by CVE-2025-15420?

CVE-2025-15420 affects users of Yonyou KSOA version 9.0.

Is CVE-2025-15420 currently being exploited?

Yes, CVE-2025-15420 has been publicly disclosed and is at risk of active exploitation.