CVE-2025-28402

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which can be exploited by a remote attacker to elevate privileges via the changeStatus method...

CVE-2025-28410

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges...

CVE-2025-28411

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave...

PT-2025-15253 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the SysDictTypeController component. Recommendations: For RUoYi version 4.8.0, consider disabling the SysDictTypeController component as a...

CVE-2025-28405

Summary: CVE-2025-28405 affects RUoYi v4.8.0 and allows a remote attacker to escalate privileges via the changeStatus method. The issue is exploitable over the network with no user interaction, and the base CVSSv3.1 score is 9.8 (CRITICAL) , with high impact on confidentiality, integrity, and ava...

PT-2025-15239 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the menuId parameter. Recommendations: For RUoYi version 4.8.0, as a temporary workaround, consider restricting access to the vulnerable...

CVE-2025-28406

CVE-2025-28406 affects RUoYi v4.8.0. A remote attacker can escalate privileges via the experimental-like parameter jobLogId in RUoYi, leading to full/total impact as indicated by CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, CRITICAL). Connected sources note this is a privilege-...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which stems from the selectDeptTree method not properly validating the deptId parameter...

CVE-2025-28408

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...

CVE-2025-28408

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...

PT-2025-15244 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the editSave method, which does not properly validate whether the requesting user has administrative privileges before allowing modificatio...

CVE-2025-28413

A vulnerability in RUoYi v4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component. CVSS 3.1: 9.8 (Network exploit, no user interaction). Affects RUoYi 4.8.0 with high impact to confidentiality, integrity, and availability. Public sources do not detail the roo...

CVE-2025-28407

CVE-2025-28407 affects RUoYi v4.8.0. A remote attacker can escalate privileges through the /edit/{dictId} endpoint due to insufficient permission validation on dictId modification. The CVE indicates high impact (CVSS 3.1: 8.8, Network/Low complexity, Privileges Required: Low, User Interaction: No...

PT-2025-15252 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the "/editSave" method in SysNoticeController. Recommendations: For RUoYi version 4.8.0, as a temporary workaround, consider disabling the...

PT-2025-15245 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the changeStatus method. Recommendations: For RUoYi version 4.8.0, consider disabling the changeStatus method until a patch is available...

CVE-2025-28412

CVE-2025-28412 affects RUoYi v4.8.0. The issue enables a remote attacker to escalate privileges through the SysNoticeController.editSave method. Root cause details are not fully disclosed in the provided documents, but multiple sources confirm a privilege escalation vulnerability with a high/crit...

PT-2025-15250 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the cancelAuthUserAll method, which does not properly validate whether the requesting user has administrative privileges. Recommendations:...

CVE-2025-28409

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/parentId endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which can be exploited by a remote attacker to elevate privileges via the postID parameter...