CVE-2026-52614

CVE-2026-52614 - RuoYi v4.8.3 filterKeyword Bypass SQL Injection 中文 | English Authorization required / 仅限授权测试 This repository is intended for security research and authorized testing only. Do not use it against systems without explicit permission. 本仓库仅用于安全研究与已获明确授权的测试。请勿对未授权系统使用。 中文说明 漏洞简介 RuoYi...

CVE-2026-110610

The ruoyi-vue-pro framework (versions through 2026.09 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the yudao-module-ai image service. Specifically, the midjourney imagine endpoint fails to properly validate the referImageUrl parameter. This allows authenticated users to fo...

CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...

EUVD-2026-101238

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110107

Versions of RuoYi-Cloud-Plus through 6.0.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the application fails to perform ownership checks when processing the DELETE /auth/unlock/{socialId} request. An authenticated attacker can exploit this b...

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-110106

Versions of RuoYi-Vue-Plus through 6.0.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows authenticated users to delete the social login bindings of other users by providing a specific socialId . Specifically, an attacker can send a DELETE /auth/unlock/...

CVE-2026-110107: Authorization Bypass Through User-Controlled Key

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId, which deletes syssocial rows by primary key without...

CVE-2026-110106: Authorization Bypass Through User-Controlled Key

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/socialId requests with a victim's binding id to remove their...

CVE-2026-108825

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has bee...

CVE-2026-108825 yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has bee...

CVE-2026-108825

The yangzongzhuan RuoYi framework, up to version 4.8.3 , is vulnerable to improper privilege management. The flaw exists in the checkRoleAllowed function within the /system/role/authDataScope file, where manipulating the roleKey argument allows for unauthorized access. This vulnerability is remot...

EUVD-2026-97324

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has bee...

CVE-2026-108803

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...