CVE-2024-57521-SQL-Injection-PoC

Iniezione SQL autenticata in RuoYi v4.7.9 Bypass di CVE-2024-42900 Introduzione Ho scoperto una vulnerabilità di Blind SQL Injection nella funzionalità createTable del framework RuoYi v4.7.9. Ciò consente a un amministratore autenticato di eseguire comandi SQL arbitrari tramite il parametro sql. ...

CVE-2026-38812-RuoYi-SQL-Injection

root@kitploit: CVE ID CVE-2026-38812 PRODOTTO RuoYi VERSIONE v4.8.2 TIPO DI PROBLEMA SQL Injection DESCRIZIONE RuoYi v4.8.2 è vulnerabile a SQL Injection tramite l'endpoint /tool/gen/createTable...

RuoYI-4.2-Shiro-721-Docker-PoC

RuoYI 4.2 Shiro 1.4.1 Ambiente di riproduzione della vulnerabilità Shiro-721 Utilizzato per riprodurre la vulnerabilità Shiro-721 CVE-2019-12422 su RuoYI. Attenzione: questo servizio presenta gravi vulnerabilità. Utilizzare solo per scopi di riproduzione delle vulnerabilità, non in ambienti di...

CVE-2026-52614

CVE-2026-52614 - RuoYi v4.8.3 filterKeyword SQL-Injection-Umgehung Chinesisch | Englisch Autorisierung erforderlich / Nur für autorisierte Tests Dieses Repository ist ausschließlich für Sicherheitsforschung und autorisierte Tests bestimmt. Verwenden Sie es nicht gegen Systeme ohne ausdrückliche...

CVE-2026-77795

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

CVE-2026-77795 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

EUVD-2026-64045

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

CVE-2026-77795

Dromara RuoYi-Vue-Plus (up to 5.6.2 ) is affected by an improper authorization vulnerability in the Workflow Endpoint component. The issue impacts the functions FlwInstanceController , FlwDefinitionController , FlwCategoryController , FlwSpelController , and TestLeaveController , allowing a remot...

PT-2026-79431

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

CVE-2026-76576

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

CVE-2026-76576

The CommonController.java fileDownload/resourceDownload function in RuoYi-Vue up to 3.9.2 allows remote path traversal via the fileName/resource argument. CVSS 4.3 (MEDIUM). A PoC exploit exists; the vendor has not responded. No patch version is provided in the documents.

CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

EUVD-2026-62846

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

PT-2026-78683

Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi-Vue versions prior to 3.9.3 Description A path traversal issue exists in the Common Download Endpoint within the fileDownload and resourceDownload functions of the CommonController.java file. A remote attacker can manipulat...

📄 ICS-Park Smart Park Management System 2.0 Privilege Escalation

A proof of concept exploit for a privilege escalation vulnerability in ICS-Park Smart Park Management System version 2.0. Missing authorization checks allow an authenticated low-privileged user to create a role containing arbitrary permissions, assign that role to their own account, and create ne...

CVE-2026-58176

RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task FlwTaskController without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global...

CVE-2026-58176 RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints

RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task FlwTaskController without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global...

CVE-2026-58176

RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task FlwTaskController without any permission check: the controller declares no class-level or method-level authorization annotation, so the endpoints are gated only by global...

CVE-2026-58176

CVE-2026-58176 affects RuoYi-Vue-Plus up to version 5.6.2. The FlwTaskController’s /workflow/task endpoints lacked any class- or method-level authorization, leaving task management actions (updateAssignee, urging tasks, and listing with pageByAllTaskWait/pageByAllTaskFinish) gated only by global ...