Vulnerabilities

TI-2026-85229 CVE-2026-122016 · GHSA-258p-479w-x2p2

Improper privilege management in RuoYi-Vue permission service

LOW 24

A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-11-04 No fix listed CWE-266

TI-2026-70927 CVE-2026-108825 · GHSA-946j-8q75-jp6v

Improper privilege management in RuoYi role authorization

MEDIUM 57

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-12 No fix listed CWE-266

TI-2026-70882 CVE-2026-108803 · GHSA-g882-pgw7-c79v

Session expiration flaw in y_project RuoYi Disable API

LOW 23

A security vulnerability has been detected in y_project RuoYi up to 4.8.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00201 Published 2026-10-12 No fix listed CWE-613

TI-2026-70881 CVE-2026-108802 · GHSA-pq38-jcrf-2whw

Cross-site scripting in RuoYi Dictionary Data Drawer Preview

MEDIUM 56

A weakness has been identified in y_project RuoYi up to 4.8.3.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00199 Published 2026-10-12 No fix listed CWE-79

TI-2026-70879 CVE-2026-108800 · GHSA-3q28-53f9-g9ch

Cross-site request forgery in yangzongzhuan RuoYi

MEDIUM 63

A vulnerability was identified in yangzongzhuan RuoYi 4.8.3.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00155 Published 2026-10-12 No fix listed CWE-352

TI-2026-53516 CVE-2026-76576 · GHSA-7jpm-353p-cprm

yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

MEDIUM 57

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00467 Published 2026-08-19 No fix listed CWE-22

TI-2026-08224 CVE-2026-9374 · GHSA-f863-6qfw-2v78

yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload

LOW 23

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00195 Published 2026-05-24 No fix listed CWE-284

TI-2026-03968 CVE-2026-4564 · GHSA-g23v-6jmr-rc3m

yangzongzhuan RuoYi Quartz Job job code injection

MEDIUM 56

A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00329 Published 2026-03-22 No fix listed CWE-74

TI-2025-43184 CVE-2025-70986 · GHSA-rchw-8w6p-7f7r

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized…

HIGH 72

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00436 Published 2026-01-23 No fix listed CWE-284

TI-2025-43183 CVE-2025-70985 · GHSA-fwg4-qwcv-hw45

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized…

HIGH 78

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00415 Published 2026-01-23 No fix listed CWE-284

TI-2024-37923 CVE-2024-57521 · GHSA-r6g5-8v9h-7ww8

SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to…

HIGH 82

SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00683 Published 2025-12-23 No fix listed CWE-89

TI-2025-13551 CVE-2025-14856 · GHSA-m5wr-8mwj-cqpw

y_project RuoYi getnames code injection

LOW 24

A security vulnerability has been detected in y_project RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00441 Published 2025-12-18 No fix listed CWE-74

TI-2025-41194 CVE-2025-67342 · GHSA-3cmr-m8h4-f7xj

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the…

LOW 20

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00177 Published 2025-12-12 No fix listed CWE-79

TI-2025-35325 CVE-2025-56396 · GHSA-xhr6-7rpm-rmv3

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges…

MEDIUM 40

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00347 Published 2025-11-26 No fix listed CWE-284

TI-2025-28958 CVE-2025-46175 · GHSA-7rgc-r95x-r2m3

Ruoyi v4.8.0 is vulnerable to Incorrect Access Control.

LOW 39

Ruoyi v4.8.0 is vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00326 Published 2025-11-26 No fix listed CWE-284

TI-2025-28957 CVE-2025-46174 · GHSA-7rvm-47hf-m85c

Ruoyi v4.8.0 vulnerable to Incorrect Access Control.

LOW 39

Ruoyi v4.8.0 vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00326 Published 2025-11-26 No fix listed CWE-284

TI-2025-10060 CVE-2025-10989 · GHSA-47xx-5583-pmg9

yangzongzhuan RuoYi selectAll improper authorization

LOW 24

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00406 Published 2025-09-26 No fix listed CWE-266

TI-2025-09602 CVE-2025-10473 · GHSA-3p28-j3wx-qv7m

yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection

MEDIUM 57

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00408 Published 2025-09-15 No fix listed CWE-74

TI-2025-09517 CVE-2025-10384 · GHSA-rcg6-pw8r-pvqr

yangzongzhuan RuoYi Role cancelAll improper authorization

LOW 24

A flaw has been found in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00375 Published 2025-09-13 No fix listed CWE-266

TI-2025-08098 CVE-2025-8847 · GHSA-5c25-h2vr-36rp

yangzongzhuan RuoYi edit cross site scripting

MEDIUM 56

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00372 Published 2025-08-11 No fix listed CWE-79

TI-2025-07231 CVE-2025-7907 · GHSA-r3pp-w9mm-8fcc

yangzongzhuan RuoYi Druid application-druid.yml default credentials

MEDIUM 57

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00512 Published 2025-07-20 No fix listed CWE-1392

TI-2025-07230 CVE-2025-7906 · GHSA-v2fm-69vv-qrc5

yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload

MEDIUM 57

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00369 Published 2025-07-20 No fix listed CWE-284

TI-2025-07227 CVE-2025-7903 · GHSA-r7mw-vcw7-q6mr

yangzongzhuan RuoYi Image Source ui layer

MEDIUM 57

A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00292 Published 2025-07-20 No fix listed CWE-1021

TI-2025-07226 CVE-2025-7902 · GHSA-6pmc-2wx6-f9jj

yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting

MEDIUM 56

A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00318 Published 2025-07-20 No fix listed CWE-79

TI-2025-07225 CVE-2025-7901 · GHSA-rfpq-8997-wr58

yangzongzhuan RuoYi Swagger UI index.html cross site scripting

MEDIUM 57

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00886 Published 2025-07-20 No fix listed CWE-79

Vulnerabilities

Filters