RU
Product
RuoYi
62
CVEs
0
On KEV
10.0
Max CVSS
4
New 30D
Severity mix
Critical 18High 15Medium 27Low 2
Watch
Add RuoYi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-28401 | 6.7 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter Affected: 4.8.0 |
| CVE-2025-28400 | 6.7 | Apr 7 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method Affected: 4.8.0 |
| CVE-2024-57437 | 6.5 | Jan 29 | RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list Affected: 4.8.0 |
| CVE-2022-23869 | 6.5 | Mar 30 | In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the… Affected: 4.7.2 |
| CVE-2026-108803 | 6.3 | Oct 12 | y_project RuoYi Disable API add changeStatus session expiration Affected: 4.8.0; 4.8.1; 4.8.2; 4.8.3 |
| CVE-2024-54762 | 6.3 | Jan 9 | Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability Affected: through 4.7.9 |
| CVE-2025-7901 | 6.1 | Jul 20 | yangzongzhuan RuoYi Swagger UI index.html cross site scripting Affected: through 4.8.1 |
| CVE-2024-9048 | 6.1 | Sep 21 | y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting Affected: through 4.7.9 |
| CVE-2024-42900 | 6.1 | Aug 28 | Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create Affected: through 4.7.9 |
| CVE-2024-41599 | 6.1 | Jul 19 | Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method Affected: through 4.7.9 |
| CVE-2024-6511 | 6.1 | Jul 4 | y_project RuoYi Content-Type isJsonRequest cross site scripting Affected: through 4.7.9 |
| CVE-2023-7133 | 6.1 | Dec 28 | y_project RuoYi HTTP POST Request login cross site scripting Affected: 4.7.8 |
| CVE-2023-3815 | 6.1 | Jul 21 | y_project RuoYi File Upload uploadFilesPath cross site scripting Affected: through 4.7.7 |
| CVE-2026-108825 | 5.4 | Oct 12 | yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management Affected: 4.8.0; 4.8.1; 4.8.2; 4.8.3 |
| CVE-2025-10384 | 5.4 | Sep 13 | yangzongzhuan RuoYi Role cancelAll improper authorization Affected: through 4.8.1 |
| CVE-2025-8847 | 5.4 | Aug 11 | yangzongzhuan RuoYi edit cross site scripting Affected: through 4.8.1 |
| CVE-2025-7906 | 5.4 | Jul 20 | yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload Affected: through 4.8.1 |
| CVE-2025-7903 | 5.4 | Jul 20 | yangzongzhuan RuoYi Image Source ui layer Affected: through 4.8.1 |
| CVE-2025-7902 | 5.4 | Jul 20 | yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting Affected: through 4.8.1 |
| CVE-2024-57438 | 5.4 | Jan 29 | Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles Affected: 4.8.0 |
| CVE-2022-32065 | 5.4 | Jul 13 | An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file Affected: through 4.7.3 |
| CVE-2024-57439 | 4.9 | Jan 29 | An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account Affected: 4.8.0 |
| CVE-2026-4564 | 4.7 | Mar 22 | yangzongzhuan RuoYi Quartz Job job code injection Affected: 4.8.0; 4.8.1; 4.8.2 |
| CVE-2023-52048 | 4.7 | Feb 28 | RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/ Affected: 4.7.8 |
| CVE-2025-67342 | 4.6 | Dec 12 | RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint Affected: through 4.8.1 |
| CVE-2026-108800 | 4.3 | Oct 12 | yangzongzhuan RuoYi cross-site request forgery Affected: 4.8.3 |
| CVE-2025-7907 | 4.3 | Jul 20 | yangzongzhuan RuoYi Druid application-druid.yml default credentials Affected: through 4.8.1 |
Showing 27