Skip to content
Ruoyi vulnerabilities
Newest
-
ruoyi
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers...
CVE-2025-70986
7.5 High
-
ruoyi
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to...
CVE-2025-70985
9.1 Critical
-
ruoyi
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute...
CVE-2024-57521
Public exploit
10.0 Critical
-
ruoyi
y_project RuoYi getnames code injection
CVE-2025-14856
5.3 Medium
-
ruoyi
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu...
CVE-2025-67342
4.6 Medium
-
ruoyi
An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the...
CVE-2025-56396
8.8 High
-
ruoyi
Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope...
CVE-2025-46175
7.5 High
-
ruoyi
Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope...
CVE-2025-46174
7.5 High
-
ruoyi
yangzongzhuan RuoYi selectAll improper authorization
CVE-2025-10989
5.3 Medium
-
ruoyi
yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection
CVE-2025-10473
5.3 Medium
-
ruoyi
yangzongzhuan RuoYi Role cancelAll improper authorization
CVE-2025-10384
5.3 Medium
-
ruoyi
yangzongzhuan RuoYi edit cross site scripting
CVE-2025-8847
5.1 Medium
-
ruoyi
yangzongzhuan RuoYi Druid application-druid.yml default credentials
CVE-2025-7907
5.3 Medium
-
ruoyi
yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload
CVE-2025-7906
5.3 Medium
-
ruoyi
yangzongzhuan RuoYi Image Source ui layer
CVE-2025-7903
5.3 Medium
-
ruoyi
yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting
CVE-2025-7902
5.1 Medium
-
ruoyi
yangzongzhuan RuoYi Swagger UI index.html cross site scripting
CVE-2025-7901
5.3 Medium
-
ruoyi
y_project RuoYi Offline Logout batchForceLogout improper authorization
CVE-2025-4819
2.3 Low
-
ruoyi ruoyi-vue
yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie
CVE-2025-4537
2.3 Low
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the...
CVE-2025-28413
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave...
CVE-2025-28412
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method...
CVE-2025-28411
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the...
CVE-2025-28410
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of...
CVE-2025-28409
8.8 High
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree...
CVE-2025-28408
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of...
CVE-2025-28407
8.8 High
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
CVE-2025-28406
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus...
CVE-2025-28405
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method...
CVE-2025-28403
7.2 High
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
CVE-2025-28402
9.8 Critical
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
CVE-2025-28401
6.7 Medium
-
ruoyi
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID...
CVE-2025-28400
6.7 Medium
-
ruoyi
RuoYi vulnerable to Denial of Service by attackers with admin privileges
CVE-2024-57439
4.9 Medium
-
ruoyi
RuoYi has insecure permissions
CVE-2024-57438
5.4 Medium
-
ruoyi
RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at...
CVE-2024-57437
6.5 Medium
-
ruoyi
RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring
CVE-2024-57436
7.2 High
-
ruoyi
y_project RuoYi Whitelist getBeanName deserialization
CVE-2025-0734
5.1 Medium
-
ruoyi
Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because...
CVE-2024-54762
6.3 Medium
-
ruoyi
RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code...
CVE-2024-46076
9.8 Critical
-
ruoyi
y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
CVE-2024-9048
6.3 Medium
-
ruoyi
Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via...
CVE-2024-42900
6.1 Medium
-
ruoyi
RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter...
CVE-2024-42913
9.8 Critical
-
ruoyi
Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to...
CVE-2024-41599
6.1 Medium
-
ruoyi
y_project RuoYi Content-Type isJsonRequest cross site scripting
CVE-2024-6511
5.3 Medium
-
ruoyi
An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the...
CVE-2024-29400
7.5 High
-
ruoyi
RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the...
CVE-2023-52048
4.7 Medium
-
ruoyi
y_project RuoYi HTTP POST Request login cross site scripting
CVE-2023-7133
4.3 Medium
-
ruoyi
RuoYi vulnerable to SQL injection vulnerability
CVE-2023-49371
9.8 Critical
-
ruoyi
An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager...
CVE-2021-28411
9.8 Critical
-
ruoyi
y_project RuoYi File Upload uploadFilesPath cross site scripting
CVE-2023-3815
3.5 Low
- Show olderLoading…