781 matches found
CVE-2025-28407
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/dictId endpoint does not properly validate whether the requesting user has permission to modify the specified dictId...
CVE-2025-28413
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component...
CVE-2025-28401
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which is caused by the cancelAuthUserAll method not properly validating the requested user's permissions...
CVE-2025-28410
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges...
CVE-2025-28402
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter...
CVE-2025-28403
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings...
CVE-2025-28407
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/dictId endpoint does not properly validate whether the requesting user has permission to modify the specified dictId...
CVE-2025-28403
CVE-2025-28403 concerns RUoYi v4.8.0, where the private function/editSave allows a remote attacker to escalate privileges by modifying system configuration without validating the user’s administrative privileges. Attack vector is network-based; impact is described as high (confidentiality, integr...
CVE-2025-28409
The CVE-2025-28409 entry concerns RUoYi v4.8.0 where the add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId, enabling privilege escalation. Affected software is RUoYi v4.8.0; the underlying issue is insuffi...
PT-2025-15247 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the edit method of the "/edit/dictId" endpoint, which does not properly validate whether the requesting user has permission to modify the...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi China. A security vulnerability exists in RuoYi v.4.8.0, which originates from the editSave method in tool/gen/editSave and may result in elevated privileges...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi China. A security vulnerability exists in RuoYi v.4.8.0, which stems from an elevation of privilege in the editSave method of SysNoticeController...
CVE-2025-28403
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings...
CVE-2025-28401
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter...
CVE-2025-28402
Consolidated details: CVE-2025-28402 affects RUoYi v4.8.0 and allows a remote attacker to escalate privileges via the jobId parameter. Connected sources confirm the issue; no official patch/version fix is documented in the provided connected documents. PT-2025-15243 notes there is no information ...
CVE-2025-28401
CVE-2025-28401 concerns RUoYi v4.8.0. The vulnerability allows a remote attacker to escalate privileges via the menuId parameter. The PT-2025-15239 advisory provides a workaround: restrict access to the vulnerable menuId parameter until a patch is available; there is no confirmed fix version in t...
CVE-2025-28412
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController...