Priority HIGH 72
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-01-23 · No fix listed CWE-284
Priority HIGH 78
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00415 · Published 2026-01-23 · No fix listed CWE-284
Priority HIGH 82
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00683 · Published 2025-12-23 · No fix listed CWE-89
Priority LOW 24
A security vulnerability has been detected in y_project RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00441 · Published 2025-12-18 · No fix listed CWE-74
Priority LOW 20
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00177 · Published 2025-12-12 · No fix listed CWE-79
Priority MEDIUM 40
An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00347 · Published 2025-11-26 · No fix listed CWE-284
Priority LOW 39
Ruoyi v4.8.0 is vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00326 · Published 2025-11-26 · No fix listed CWE-284
Priority LOW 39
Ruoyi v4.8.0 vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00326 · Published 2025-11-26 · No fix listed CWE-284
Priority LOW 24
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00406 · Published 2025-09-26 · No fix listed CWE-266
Priority MEDIUM 57
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00408 · Published 2025-09-15 · No fix listed CWE-74
Priority LOW 24
A flaw has been found in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00375 · Published 2025-09-13 · No fix listed CWE-266
Priority MEDIUM 56
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00372 · Published 2025-08-11 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00512 · Published 2025-07-20 · No fix listed CWE-1392
Priority MEDIUM 57
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00369 · Published 2025-07-20 · No fix listed CWE-284
Priority MEDIUM 57
A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00292 · Published 2025-07-20 · No fix listed CWE-1021
Priority MEDIUM 56
A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00318 · Published 2025-07-20 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00886 · Published 2025-07-20 · No fix listed CWE-79
Priority MEDIUM 45
A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00485 · Published 2025-05-17 · No fix listed CWE-266
Priority HIGH 82
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00664 · Published 2025-04-07 · No fix listed CWE-284
Priority HIGH 82
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00664 · Published 2025-04-07 · No fix listed CWE-284
Priority HIGH 82
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00664 · Published 2025-04-07 · No fix listed CWE-284
Priority HIGH 82
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00664 · Published 2025-04-07 · No fix listed CWE-284
Priority HIGH 73
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00588 · Published 2025-04-07 · No fix listed CWE-284
Priority HIGH 82
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the deptId parameter
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00664 · Published 2025-04-07 · No fix listed CWE-284
Priority HIGH 73
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified d…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00588 · Published 2025-04-07 · No fix listed CWE-284
Load more
THREATIST.IORead the docs