CVE-2025-15436: Yonyou KSOA work_edit.jsp sql injection

Published Jan 2, 2026

Updated

A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/workedit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Yonyou KSOA

Yonyou KSOA=9.0

Event History

Jan 2, 2026

CVE Published

via MITRE·08:02 AM

Data Sourced

via MITRE·08:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-15436?

CVE-2025-15436 has a high severity rating due to its potential for remote SQL injection attacks.

How do I fix CVE-2025-15436?

To fix CVE-2025-15436, ensure that you sanitize and validate all user inputs in the affected file /worksheet/work_edit.jsp.

Who is affected by CVE-2025-15436?

CVE-2025-15436 affects users of Yonyou KSOA 9.0 that utilize the vulnerable feature of the application.

Can CVE-2025-15436 be exploited remotely?

Yes, CVE-2025-15436 can be exploited remotely by manipulating the 'Report' argument.

What type of vulnerability is CVE-2025-15436?

CVE-2025-15436 is classified as an SQL injection vulnerability that can compromise the security of the Yonyou KSOA application.