RuoYi 跨站脚本漏洞

RuoYi is a backend management system for individual developers of China RuoYi RuoYi. A security vulnerability exists in RuoYi v4.7.3 and below, which stems from an arbitrary file upload vulnerability in the backend management module that allows an attacker to execute arbitrary code via a speciall...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

Cross site request forgery (csrf)

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

Input validation

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23869

In RuoYi v4.7.2 WebUI, there is a privilege-check bypass in password reset: user test1 cannot reset test3’s password per permissions, yet the /system/user/resetPwd endpoint can reset test3’s password, enabling unauthorized password-reset actions.

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23868

CVE-2022-23868 affects RuoYi v4.7.2 via the ruoyi-admin interface, describing a CSV injection vulnerability when a victim opens an .xlsx log file. The connected Red Hat entry corroborates the same product/version. CVSS‑3.1 base score is 7.8 (HIGH) with LOCAL attack, user interaction required, and...

CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.7.2, which originates from the fact that in the RuoYi v4.7.2 interface, the user test1 does not have the privilege to reset the password of the user test3, but can request...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.7.2, there is no information about the vulnerability at the moment, please keep an eye on CNNVD or the vendor's announcement...

SQL Injection Vulnerability in Ruoyi Management System (CNVD-2021-39812)

Ruoyi management system is based on SpringBoot2.0 rights management system . A SQL injection vulnerability exists in Ruoyi Management System, which can be exploited by an attacker to obtain sensitive information from the database...

SQL Injection Vulnerability in Ruoyi Management System (CNVD-2021-36506)

Ruoyi management system is based on SpringBoot2.0 permissions management system, the core technology using SpringBoot, MyBatis, Shiro, Thymeleaf, Bootstrap, Vue and so on. The system suffers from a SQL injection vulnerability, which can be exploited by an attacker to obtain sensitive information...

If a deserialization vulnerability exists in CMS

Ruoyi CMS is a set of domestic SpringBoot-based rights management system . Ruoyi CMS has a deserialization vulnerability that can be exploited by an attacker to deserialize arbitrary code execution by sending a JNDI request...

SQL Injection Vulnerability in Ruoyi Management System

Ruoyi management system is based on SpringBoot2.0 permissions management system, the core technology using SpringBoot, MyBatis, Shiro, Thymeleaf, Bootstrap, Vue and so on. The system suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information fr...

Arbitrary File Download Vulnerability in Ruoyi Management System

Ruoyi management system is a SpringBoot2.0 based on the use of Spring, MyBatis, Shiro rights management system . Ruoyi Management System has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...