Ruoyi vulnerabilities
Published CVEs affecting Ruoyi products: 9 record(s), with severity, exploitation and fixes.
CVE-2025-70986
High · 7.5
CWE-284 Jan 23, 2026
Improper Access Control in Ruoyi
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
CVE-2025-70985
Critical · 9.1
CWE-284 Jan 23, 2026
Improper Access Control in Ruoyi
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
CVE-2024-57521
Critical · 10.0
CWE-89 Dec 23, 2025
SQL Injection in Ruoyi
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
CVE-2025-14856
High · 8.8
CWE-74 Dec 17, 2025
y_project RuoYi getnames code injection
A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-67342
Medium · 4.6
CWE-79 Dec 12, 2025
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu...
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
CVE-2025-46175
High · 7.5
CWE-862 Nov 26, 2025
Missing Authorization in Ruoyi
Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
CVE-2025-56396
High · 8.8
CWE-284 Nov 26, 2025
Improper Access Control in Ruoyi
An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.
CVE-2025-46174
High · 7.5
CWE-862 Nov 26, 2025
Missing Authorization in Ruoyi
Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.
CVE-2025-10989
High · 8.8
CWE-266 Sep 25, 2025
yangzongzhuan RuoYi selectAll improper authorization
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.