SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java

yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has…

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the…

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter

RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code

RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1

RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit

An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate…

RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable

Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework

y_project RuoYi GenController sql injection

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope

y_project RuoYi getnames code injection

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user

yangzongzhuan RuoYi selectAll improper authorization

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user…

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user…

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data

Ruoyi v4.8.0 is vulnerable to Incorrect Access Control

Ruoyi v4.8.0 vulnerable to Incorrect Access Control

An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter

y_project RuoYi filterKeyword resource consumption

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative…

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring

y_project RuoYi Whitelist getBeanName deserialization

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method

RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the…

y_project RuoYi Disable API add changeStatus session expiration

Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability

yangzongzhuan RuoYi Swagger UI index.html cross site scripting

y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting

Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create

Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method

y_project RuoYi Content-Type isJsonRequest cross site scripting

y_project RuoYi HTTP POST Request login cross site scripting

y_project RuoYi File Upload uploadFilesPath cross site scripting

yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management

yangzongzhuan RuoYi Role cancelAll improper authorization

yangzongzhuan RuoYi edit cross site scripting

yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload