RU
Product
RuoYi
62
CVEs
0
On KEV
10.0
Max CVSS
4
New 30D
Severity mix
Critical 18High 15Medium 27Low 2
Watch
Add RuoYi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-14856 | 8.8 | Dec 18 | y_project RuoYi getnames code injection Affected: 4.8.0; 4.8.1 |
| CVE-2025-56396 | 8.8 | Nov 26 | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user Affected: 4.8.1 |
| CVE-2025-10989 | 8.8 | Sep 26 | yangzongzhuan RuoYi selectAll improper authorization Affected: through 4.8.1 |
| CVE-2025-28407 | 8.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user… Affected: 4.8.0 |
| CVE-2025-28409 | 8.8 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user… Affected: 4.8.0 |
| CVE-2022-23868 | 7.8 | Mar 30 | RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file Affected: 4.7.2 |
| CVE-2025-70986 | 7.5 | Jan 23 | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data Affected: 4.8.1; 4.8.2 |
| CVE-2025-46175 | 7.5 | Nov 26 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control Affected: 4.8.0 |
| CVE-2025-46174 | 7.5 | Nov 26 | Ruoyi v4.8.0 vulnerable to Incorrect Access Control Affected: 4.8.0 |
| CVE-2024-29400 | 7.5 | Apr 12 | An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter Affected: 4.5.1 |
| CVE-2023-3163 | 7.5 | Jun 8 | y_project RuoYi filterKeyword resource consumption Affected: through 4.7.7 |
| CVE-2023-27025 | 7.5 | Apr 2 | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server Affected: through 4.7.6 |
| CVE-2025-28403 | 7.2 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative… Affected: 4.8.0 |
| CVE-2024-57436 | 7.2 | Jan 29 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring Affected: 4.8.0 |
| CVE-2025-0734 | 7.2 | Jan 27 | y_project RuoYi Whitelist getBeanName deserialization Affected: through 4.8.0 |
Showing 15