YA
Vendor
yangzongzhuan
64
CVEs
0
On KEV
4
New 30D
Products
RU10.0
RuoYi
yangzongzhuan
62 CVEs0 on KEV4 new
RU6.1
Ruoyi-cloud
Ruoyi
1 CVEs0 on KEV0 new
RU3.1
Ruoyi-vue
Ruoyi
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108825 | RU RuoYi yangzongzhuan | 5.4 | Oct 12 | yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management |
| CVE-2026-108803 | RU RuoYi y_project | 6.3 | Oct 12 | y_project RuoYi Disable API add changeStatus session expiration |
| CVE-2026-108802 | RU RuoYi y_project | 3.5 | Oct 12 | y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting |
| CVE-2026-108800 | RU RuoYi yangzongzhuan | 4.3 | Oct 12 | yangzongzhuan RuoYi cross-site request forgery |
| CVE-2026-4564 | RU RuoYi yangzongzhuan | 4.7 | Mar 22 | yangzongzhuan RuoYi Quartz Job job code injection |
| CVE-2025-70985 | RU Ruoyi Ruoyi | 9.1 | Jan 23 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope |
| CVE-2025-70986 | RU Ruoyi Ruoyi | 7.5 | Jan 23 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data |
| CVE-2024-57521 | RU Ruoyi Ruoyi | 10.0 | Dec 23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java |
| CVE-2025-14856 | RU RuoYi y_project | 8.8 | Dec 18 | y_project RuoYi getnames code injection |
| CVE-2025-67342 | RU Ruoyi Ruoyi | 4.6 | Dec 12 | RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint |
| CVE-2025-46174 | RU Ruoyi Ruoyi | 7.5 | Nov 26 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control |
| CVE-2025-46175 | RU Ruoyi Ruoyi | 7.5 | Nov 26 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control |
| CVE-2025-56396 | RU Ruoyi Ruoyi | 8.8 | Nov 26 | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user |
| CVE-2025-10989 | RU Ruoyi Ruoyi | 8.8 | Sep 26 | yangzongzhuan RuoYi selectAll improper authorization |
| CVE-2025-10473 | RU Ruoyi Ruoyi | 9.8 | Sep 15 | yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection |
| CVE-2025-10384 | RU Ruoyi Ruoyi | 5.4 | Sep 13 | yangzongzhuan RuoYi Role cancelAll improper authorization |
| CVE-2025-8847 | RU Ruoyi Ruoyi | 5.4 | Aug 11 | yangzongzhuan RuoYi edit cross site scripting |
| CVE-2025-7907 | RU Ruoyi Ruoyi | 4.3 | Jul 20 | yangzongzhuan RuoYi Druid application-druid.yml default credentials |
| CVE-2025-7906 | RU Ruoyi Ruoyi | 5.4 | Jul 20 | yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload |
| CVE-2025-7903 | RU Ruoyi Ruoyi | 5.4 | Jul 20 | yangzongzhuan RuoYi Image Source ui layer |
| CVE-2025-7902 | RU Ruoyi Ruoyi | 5.4 | Jul 20 | yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting |
| CVE-2025-7901 | RU Ruoyi Ruoyi | 6.1 | Jul 20 | yangzongzhuan RuoYi Swagger UI index.html cross site scripting |
| CVE-2025-4819 | RU Ruoyi Ruoyi | 3.1 | May 17 | y_project RuoYi Offline Logout batchForceLogout improper authorization |
| CVE-2025-4537 | RU Ruoyi-vue Ruoyi | 3.1 | May 11 | yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie |
| CVE-2025-28410 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has… |
| CVE-2025-28400 | RU Ruoyi Ruoyi | 6.7 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method |
| CVE-2025-28401 | RU Ruoyi Ruoyi | 6.7 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter |
| CVE-2025-28402 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter |
| CVE-2025-28403 | RU Ruoyi Ruoyi | 7.2 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative… |
| CVE-2025-28405 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method |
| CVE-2025-28406 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter |
| CVE-2025-28407 | RU Ruoyi Ruoyi | 8.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user… |
| CVE-2025-28408 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the… |
| CVE-2025-28409 | RU Ruoyi Ruoyi | 8.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user… |
| CVE-2025-28411 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave |
| CVE-2025-28412 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController |
| CVE-2025-28413 | RU Ruoyi Ruoyi | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component |
| CVE-2024-57438 | RU Ruoyi Ruoyi | 5.4 | Jan 29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles |
| CVE-2024-57439 | RU Ruoyi Ruoyi | 4.9 | Jan 29 | An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account |
| CVE-2024-57436 | RU Ruoyi Ruoyi | 7.2 | Jan 29 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring |
| CVE-2024-57437 | RU Ruoyi Ruoyi | 6.5 | Jan 29 | RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list |
| CVE-2025-0734 | RU Ruoyi Ruoyi | 7.2 | Jan 27 | y_project RuoYi Whitelist getBeanName deserialization |
| CVE-2024-54762 | RU Ruoyi Ruoyi | 6.3 | Jan 9 | Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability |
| CVE-2024-46076 | RU Ruoyi Ruoyi | 9.8 | Oct 7 | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code |
| CVE-2024-9048 | RU Ruoyi Ruoyi | 6.1 | Sep 21 | y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting |
| CVE-2024-42900 | RU Ruoyi Ruoyi | 6.1 | Aug 28 | Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create |
| CVE-2024-42913 | RU Ruoyi Ruoyi | 9.8 | Aug 26 | RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1 |
| CVE-2024-41599 | RU Ruoyi Ruoyi | 6.1 | Jul 19 | Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method |
| CVE-2024-6511 | RU Ruoyi Ruoyi | 6.1 | Jul 4 | y_project RuoYi Content-Type isJsonRequest cross site scripting |
| CVE-2024-29400 | RU Ruoyi Ruoyi | 7.5 | Apr 12 | An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter |
| CVE-2023-52048 | RU Ruoyi Ruoyi | 4.7 | Feb 28 | RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/ |
| CVE-2023-7133 | RU Ruoyi Ruoyi | 6.1 | Dec 28 | y_project RuoYi HTTP POST Request login cross site scripting |
| CVE-2023-49371 | RU Ruoyi Ruoyi | 9.8 | Dec 1 | RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit |
| CVE-2021-28411 | RU Ruoyi Ruoyi | 9.8 | Aug 11 | An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate… |
| CVE-2023-3815 | RU Ruoyi Ruoyi | 6.1 | Jul 21 | y_project RuoYi File Upload uploadFilesPath cross site scripting |
| CVE-2023-3163 | RU Ruoyi Ruoyi | 7.5 | Jun 8 | y_project RuoYi filterKeyword resource consumption |
| CVE-2023-27025 | RU Ruoyi Ruoyi | 7.5 | Apr 2 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server |
| CVE-2022-48114 | RU Ruoyi Ruoyi | 9.8 | Feb 2 | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable |
| CVE-2022-4566 | RU Ruoyi Ruoyi | 9.8 | Dec 16 | y_project RuoYi GenController sql injection |
| CVE-2021-38241 | RU Ruoyi Ruoyi | 9.8 | Dec 16 | Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework |