Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0046 37.7 —
AFFECTED Product Versions Fixed U8 CRM 16.1 – 18
TIMELINE Sep 30 Reserved by VulnCheck Sep 30 Published (CNA: VulnCheck) Oct 2 EXPLOIT PUBLISHED — CVE-2023-54403 (Yonyou U8 CRM). Public exploit reference added.
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
| Date | Event | Detail |
|---|---|---|
| September 30, 2026 | Reserved | Reserved by VulnCheck |
| September 30, 2026 | Published | Published (CNA: VulnCheck) |
| October 2, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2023-54403 (Yonyou U8 CRM). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Yonyou | U8 CRM | — | 16.1 | 18 |
Authoritative record: CVE-2023-54403 at cve.org
Vendors: yonyou
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-54403 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
