781 matches found
RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
CVE-2024-57436
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
CVE-2024-57439
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
CVE-2024-57438
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...
CVE-2024-57437
RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...
RuoYi 安全漏洞
RuoYi is a backend management system by the individual developer RuoYi in China. A security vulnerability exists in RuoYi v4.8.0, which is caused by an SQL injection via the orderby parameter in /monitor/online/list...
CVE-2024-57436
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
CVE-2024-57439
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
PT-2025-3446 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: ruoyi version 4.8.0 Description: The issue is related to the reset password interface, where attackers with Admin privileges can cause a Denial of Service DoS by duplicating the login name of the account. Recommendations: ruoyi version 4.8.0:...
CVE-2024-57438
The CVE-2024-57438 entry concerns insecure permissions in RuoYi v4.8.0 that allow an authenticated attacker to escalate privileges by self-assigning higher-level roles. Affected component: RuoYi core authorization/role-assignment mechanism; root cause is insecure permission controls enabling priv...
CVE-2024-57436
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
CVE-2024-57439
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
CVE-2024-57437
RuoYi (software) v4.8.0 contains a SQL injection vulnerability in the /monitor/online/list endpoint, exploitable via the orderby parameter. The CVE-2024-57437 entry lists a CVSS v3.1 base score of 6.5 (MEDIUM) with Network attack vector, low attack complexity, and privileges required. The impact ...
PT-2025-3443 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: The issue allows unauthorized attackers to view the session ID of the admin in the system monitoring, enabling them to impersonate Admin users via a crafted cookie. Recommendations: RuoYi version 4.8.0: Update...
CVE-2024-57436
RuoYi v4.8.0 contains an exposure in the system monitoring session handling where an unauthenticated user could view the admin session ID via a crafted cookie, enabling admin impersonation. The issue is documented across multiple sources (CVE-2024-57436) and is classified with high impact (confid...
PT-2025-3444 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: A SQL injection issue was found in RuoYi via the orderby parameter at the "/monitor/online/list" API endpoint. Recommendations: For RuoYi version 4.8.0, as a temporary workaround, consider restricting access t...
CVE-2024-57439
CVE-2024-57439 affects Ruoyi v4.8.0. The vulnerability resides in the reset password interface, where attackers with Admin privileges can trigger a Denial of Service by duplicating the login name of an account. Affected component is the reset-password flow; root cause and exact code path are not ...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.8.0, which stems from the presence of an insecure privilege that allows an authenticated attacker to elevate privileges by assigning himself a higher-level role...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi version v4.8.0, which originates from allowing an unauthorized attacker to view an administrator's session ID in System Monitor...