CVE-2025-70986 | High | 7.5 | 2026-01-23 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data. |
CVE-2025-70985 | Critical | 9.1 | 2026-01-23 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope. |
CVE-2024-57521 | Critical | 10.0 | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java. |
CVE-2025-14856 | Medium | 6.3 | 2025-12-18 | A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Suc… |
CVE-2025-67342 | Medium | 4.6 | 2025-12-12 | RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter… |
CVE-2025-46175 | High | 7.5 | 2025-11-26 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java. |
CVE-2025-56396 | High | 8.8 | 2025-11-26 | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user. |
CVE-2025-46174 | High | 7.5 | 2025-11-26 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java. |
CVE-2025-10989 | Medium | 6.3 | 2025-09-26 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Pe… |
CVE-2025-10473 | Medium | 6.3 | 2025-09-15 | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil… |
CVE-2025-10384 | Medium | 5.4 | 2025-09-13 | A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAl… |
CVE-2025-8847 | Low | 3.5 | 2025-08-11 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipula… |
CVE-2025-7907 | Medium | 4.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/sr… |
CVE-2025-7906 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src… |
CVE-2025-7903 | Medium | 4.3 | 2025-07-20 | A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2025-7902 | Low | 3.5 | 2025-07-20 | A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/control… |
CVE-2025-7901 | Medium | 4.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger… |
CVE-2025-4819 | Low | 3.1 | 2025-05-17 | A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout… |
CVE-2025-4537 | Low | 3.1 | 2025-05-11 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-28413 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component |
CVE-2025-28412 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController |
CVE-2025-28411 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave |
CVE-2025-28410 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting us… |
CVE-2025-28409 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether… |
CVE-2025-28408 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not prope… |
CVE-2025-28407 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether… |
CVE-2025-28406 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter |
CVE-2025-28405 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method |
CVE-2025-28403 | High | 7.2 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has ad… |
CVE-2025-28402 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter |
CVE-2025-28401 | Medium | 6.7 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter |
CVE-2025-28400 | Medium | 6.7 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method |
CVE-2024-57439 | Medium | 4.9 | 2025-01-29 | An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login nam… |
CVE-2024-57438 | Medium | 5.4 | 2025-01-29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles. |
CVE-2024-57437 | Medium | 6.5 | 2025-01-29 | RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list. |
CVE-2024-57436 | High | 7.2 | 2025-01-29 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to imp… |
CVE-2025-0734 | Medium | 4.7 | 2025-01-27 | A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component… |
CVE-2024-54762 | Medium | 6.3 | 2025-01-09 | Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injecti… |
CVE-2024-46076 | Critical | 9.8 | 2024-10-07 | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code. |
CVE-2024-9048 | Low | 3.1 | 2024-09-21 | A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImp… |
CVE-2024-42900 | Medium | 6.1 | 2024-08-28 | Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/c… |
CVE-2024-42913 | Critical | 9.8 | 2024-08-26 | RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1. |
CVE-2024-41599 | Medium | 6.1 | 2024-07-19 | Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method |
CVE-2024-6511 | Low | 3.5 | 2024-07-04 | A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the compone… |
CVE-2024-29400 | High | 7.5 | 2024-04-12 | An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter. |
CVE-2023-52048 | Medium | 4.7 | 2024-02-28 | RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/. |
CVE-2023-7133 | Medium | 4.3 | 2023-12-28 | A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the comp… |
CVE-2023-49371 | Critical | 9.8 | 2023-12-01 | RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit. |
CVE-2021-28411 | Critical | 9.8 | 2023-08-11 | An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers t… |
CVE-2023-3815 | Low | 3.5 | 2023-07-21 | A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of… |
CVE-2023-3163 | Low | 3.5 | 2023-06-08 | A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of th… |
CVE-2023-27025 | High | 7.5 | 2023-04-02 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the serv… |
CVE-2022-48114 | Critical | 9.8 | 2023-02-02 | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable. |
CVE-2021-38241 | Critical | 9.8 | 2022-12-16 | Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework. |
CVE-2022-4566 | Medium | 5.5 | 2022-12-16 | A vulnerability, which was classified as critical, has been found in y_project RuoYi 4.7.5. This issue affects some unknown processing of the file com/ruoyi/ge… |
CVE-2022-4348 | Low | 3.5 | 2022-12-08 | A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSO… |
CVE-2022-32065 | Medium | 5.4 | 2022-07-13 | An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted H… |
CVE-2022-23869 | Medium | 6.5 | 2022-03-30 | In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through… |
CVE-2022-23868 | High | 7.8 | 2022-03-30 | RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. |