Vulnerabilidades de Ruoyi
CVEs publicadas que afetam produtos de Ruoyi: 9 registro(s), com severidade, exploração e correções.
CVE-2025-70986
Alta · 7.5
CWE-284 23/01/2026
Improper Access Control em Ruoyi
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
CVE-2025-70985
Crítica · 9.1
CWE-284 23/01/2026
Improper Access Control em Ruoyi
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.
CVE-2024-57521
Crítica · 10.0
CWE-89 23/12/2025
SQL Injection em Ruoyi
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
CVE-2025-14856
Alta · 8.8
CWE-74 17/12/2025
y_project RuoYi getnames code injection
A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-67342
Média · 4.6
CWE-79 12/12/2025
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu...
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
CVE-2025-46175
Alta · 7.5
CWE-862 26/11/2025
Missing Authorization em Ruoyi
Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
CVE-2025-56396
Alta · 8.8
CWE-284 26/11/2025
Improper Access Control em Ruoyi
An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.
CVE-2025-46174
Alta · 7.5
CWE-862 26/11/2025
Missing Authorization em Ruoyi
Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.
CVE-2025-10989
Alta · 8.8
CWE-266 25/09/2025
yangzongzhuan RuoYi selectAll improper authorization
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.