Threats tagged 'ghsa-qw2g-qp82-qw5p'

CVE-2025-10987 is a medium severity vulnerability in YunaiV yudao-cloud up to version 2025.09. It involves improper authorization in the HTTP Request Handler component, specifically in the /crm/contact/transfer functionality. The vulnerability allows remote attackers with limited privileges to manipulate the contactId argument, potentially leading to unauthorized actions. The exploit has been publicly disclosed, but no vendor response or patch is currently available.