Threats tagged 'ghsa-5qwr-m3vg-gj86'

A server-side request forgery (SSRF) vulnerability exists in YunaiV yudao-cloud up to version 2025.11, affecting the Business Process Management component's BpmHttpCallbackTrigger and BpmSyncHttpRequestTrigger functions. Manipulating the url, header, or body arguments can lead to SSRF. The vulnerability can be exploited remotely. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.