CVE-2025-15435: Yonyou KSOA work_update.jsp sql injection

Published Jan 2, 2026

Updated

A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/workupdate.jsp. This manipulation of the argument Report causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 2, 2026

CVE Published

via MITRE·07:32 AM

Data Sourced

via MITRE·07:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-15435?

CVE-2025-15435 has a high severity rating due to its potential for remote SQL injection attacks.

How do I fix CVE-2025-15435?

To fix CVE-2025-15435, it is recommended to update to the latest version of Yonyou KSOA that addresses this SQL injection vulnerability.

What type of attack does CVE-2025-15435 enable?

CVE-2025-15435 enables remote attackers to perform SQL injection through the file /worksheet/work_update.jsp.

Which software versions are affected by CVE-2025-15435?

CVE-2025-15435 affects all versions of Yonyou KSOA 9.0 that do not have the patch for this vulnerability.

Can CVE-2025-15435 be exploited remotely?

Yes, CVE-2025-15435 can be exploited remotely, making it critical for users to secure their systems.