EUVD-2023-60699

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

CVE-2023-54403

The Yonyou U8 CRM software (versions before V16.5 and V18 ) is vulnerable to an arbitrary file read flaw located in the /ajax/getemaildata.php component. Unauthenticated attackers can bypass authentication by using the DontCheckLogin=1 parameter and subsequently read arbitrary files via an unvali...