Ruoyi
by Ruoyi
Source repositories
CVEs (60)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-28407 | Hig | 0.57 | 8.8 | 0.01 | Apr 7, 2025 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified dictId | ||
| CVE-2022-23868 | Hig | 0.51 | 7.8 | 0.01 | Mar 30, 2022 | RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. | ||
| CVE-2025-70986 | Hig | 0.49 | 7.5 | 0.00 | Jan 23, 2026 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data. | ||
| CVE-2025-46175 | Hig | 0.49 | 7.5 | 0.00 | Nov 26, 2025 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java. | ||
| CVE-2025-46174 | Hig | 0.49 | 7.5 | 0.00 | Nov 26, 2025 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java. | ||
| CVE-2024-29400 | Hig | 0.49 | 7.5 | 0.01 | Apr 12, 2024 | An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter. | ||
| CVE-2023-27025 | Hig | 0.49 | 7.5 | 0.00 | Apr 2, 2023 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server. | ||
| CVE-2025-28403 | Hig | 0.47 | 7.2 | 0.01 | Apr 7, 2025 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings | ||
| CVE-2024-57436 | Hig | 0.47 | 7.2 | 0.01 | Jan 29, 2025 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie. | ||
| CVE-2025-28401 | Med | 0.44 | 6.7 | 0.00 | Apr 7, 2025 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter | ||
| CVE-2025-28400 | Med | 0.44 | 6.7 | 0.00 | Apr 7, 2025 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method | ||
| CVE-2024-57437 | Med | 0.42 | 6.5 | 0.00 | Jan 29, 2025 | RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list. | ||
| CVE-2022-23869 | Med | 0.42 | 6.5 | 0.01 | Mar 30, 2022 | In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request. | ||
| CVE-2025-14856 | Med | 0.41 | 6.3 | 0.00 | Dec 18, 2025 | A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has… | ||
| CVE-2025-10989 | Med | 0.41 | 6.3 | 0.00 | Sep 26, 2025 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely.… | ||
| CVE-2025-10473 | Med | 0.41 | 6.3 | 0.00 | Sep 15, 2025 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched… | ||
| CVE-2025-7906 | Med | 0.41 | 6.3 | 0.00 | Jul 20, 2025 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to… | ||
| CVE-2024-54762 | Med | 0.41 | 6.3 | 0.00 | Jan 9, 2025 | Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection. | ||
| CVE-2026-37216 | Med | 0.40 | 6.1 | 0.00 | Jun 15, 2026 | Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add. | ||
| CVE-2024-42900 | Med | 0.40 | 6.1 | 0.00 | Aug 28, 2024 | Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create. |
- risk 0.57cvss 8.8epss 0.01
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified dictId
- risk 0.51cvss 7.8epss 0.01
RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.
- risk 0.49cvss 7.5epss 0.00
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
- risk 0.49cvss 7.5epss 0.00
Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
- risk 0.49cvss 7.5epss 0.00
Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.
- risk 0.49cvss 7.5epss 0.00
An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.
- risk 0.47cvss 7.2epss 0.01
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings
- risk 0.47cvss 7.2epss 0.01
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.
- risk 0.44cvss 6.7epss 0.00
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
- risk 0.44cvss 6.7epss 0.00
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
- risk 0.42cvss 6.5epss 0.00
RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.
- risk 0.42cvss 6.5epss 0.01
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
- risk 0.41cvss 6.3epss 0.00
A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has…
- risk 0.41cvss 6.3epss 0.00
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely.…
- risk 0.41cvss 6.3epss 0.00
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched…
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to…
- risk 0.41cvss 6.3epss 0.00
Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection.
- risk 0.40cvss 6.1epss 0.00
Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
- risk 0.40cvss 6.1epss 0.00
Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create.
Page 2 of 3