RU
Product
RuoYi
62
CVEs
0
On KEV
10.0
Max CVSS
4
New 30D
Severity mix
Critical 18High 15Medium 27Low 2
Watch
Add RuoYi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-57521 | 10.0 | Dec 23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java Affected: through 4.7.9 |
| CVE-2025-10473 | 9.8 | Sep 15 | yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection Affected: through 4.8.1 |
| CVE-2025-28402 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter Affected: 4.8.0 |
| CVE-2025-28405 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method Affected: 4.8.0 |
| CVE-2025-28413 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component Affected: 4.8.0 |
| CVE-2025-28412 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController Affected: 4.8.0 |
| CVE-2025-28411 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave Affected: 4.8.0 |
| CVE-2025-28410 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has… Affected: 4.8.0 |
| CVE-2025-28408 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the… Affected: 4.8.0 |
| CVE-2025-28406 | 9.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter Affected: 4.8.0 |
| CVE-2024-46076 | 9.8 | Oct 7 | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code Affected: through 4.7.9 |
| CVE-2024-42913 | 9.8 | Aug 26 | RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1 Affected: 4.7.9 |
| CVE-2023-49371 | 9.8 | Dec 1 | RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit Affected: through 4.6.0 |
| CVE-2021-28411 | 9.8 | Aug 11 | An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers to escalate… Affected: 3.4.0 |
| CVE-2022-48114 | 9.8 | Feb 2 | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable Affected: through 4.7.5 |
| CVE-2021-38241 | 9.8 | Dec 16 | Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework Affected: before 4.6.1 |
| CVE-2022-4566 | 9.8 | Dec 16 | y_project RuoYi GenController sql injection Affected: 4.7.5 |
| CVE-2025-70985 | 9.1 | Jan 23 | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope Affected: 4.8.1; 4.8.2 |
Showing 18