13992 matches found
CVE-2025-28411
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave...
CVE-2024-43065
CVE-2024-43065 affects Qualcomm chipsets with cryptographic issues in the generation of asymmetric key pairs for RKP use cases. The root cause is a flaw in how key material is generated, leading to potential weaknesses in confidentiality and integrity. The CVSS base metrics indicate a high impact...
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250402T160203 2025-04-02T16:02:03Z jscPED-11136 GO-2025-3443 GO-2025-3581 GO-2025-3582 GO-2025-3583 GO-2025-3584 GO-2025-3585 GO-2025-3586 GO-2025-3587 GO-2025-3588 Patch Instructions: To install this SUSE upda...
Exploit for Improper Input Validation in Microsoft
CVE-2023-23397 Exploitation & Mitigation Demo 📌 Overview...
jinja2: Jinja sandbox breakout through attr filter selecting format method
A flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content o...
PT-2025-15252 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the "/editSave" method in SysNoticeController. Recommendations: For RUoYi version 4.8.0, as a temporary workaround, consider disabling the...
CVE-2025-28412
The backend management system RUoYi version 4.8.0 is vulnerable to a privilege escalation issue. A remote attacker can exploit the /editSave method within the SysNoticeController component. This vulnerability is categorized under CWE-284 (Improper Access Control) and has a CRITICAL base severity ...
PT-2025-15249 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the add method of the "/add/parentId" endpoint, which does not properly validate whether the requesting user has permission to add a menu...
CVE-2025-28409
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/parentId endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId...
PT-2025-15244 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the editSave method, which does not properly validate whether the requesting user has administrative privileges before allowing modificatio...
CVE-2025-28412
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController...
CVE-2025-28412
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which can be exploited by a remote attacker to elevate privileges via the changeStatus method...
PT-2025-15904
Summary Using timeit.timeit function, which is a built-in python library function to execute remote pickle file. Details Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by...
CVE-2025-28408
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...
📄 AC Repair and Services System 1.0 SQL Injection
AC Repair and Services System version 1.0 suffers from multiple remote SQL injection vulnerabilities. Titles: AC Repair and Services System - ARSS-1.0-Copyright©2025-Multiple-SQLi Author: nu11secur1ty Date: 04/05/2025 Vendor: https://github.com/oretnom23 Software:...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi version v.4.8.0, which stems from the editSave method not properly verifying the requested user privileges, which may result in modification of the system configuration...
CVE-2025-28411
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave...
CVE-2025-28410
A privilege escalation vulnerability exists in RUoYi v.4.8.0 , a backend management system. The issue stems from the cancelAuthUserAll method failing to properly validate whether the requesting user possesses administrative privileges . A remote attacker could exploit this lack of access control ...