CVE Intelligence

Yangzongzhuan RuoYi vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Yangzongzhuan RuoYi: 4 record(s), with affected versions and fixes.

CVE-2026-108825 Medium · 5.4 CWE-266 Oct 12, 2026
yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-108800 Medium · 4.3 CWE-352 Oct 12, 2026
yangzongzhuan RuoYi cross-site request forgery
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-4564 Medium · 4.7 CWE-74 Mar 22, 2026
yangzongzhuan RuoYi Quartz Job job code injection
A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monitor/job/ of the component Quartz Job Handler. Such manipulation of the argument invokeTarget leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-10989 High · 8.8 CWE-266 Sep 25, 2025
yangzongzhuan RuoYi selectAll improper authorization
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.