Lucene search
+L

789 matches found

NVD
NVD
added 2026/09/15 3:17 p.m.5 views

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

8.8CVSS0.0062EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/15 12:00 a.m.8 views

EUVD-2026-78626

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

8.8CVSS6.6AI score0.0062EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/15 12:00 a.m.11 views

CVE-2026-88616

CVE-2026-88616 affects RuoYi-Vue-Plus 6.0.0 , a Java-based enterprise management framework. The vulnerability allows a remote authenticated attacker to execute arbitrary code through the FlwTaskController.java component, specifically via FlwTaskServiceImpl.completeTask , CompleteExecuteComponent....

8.8CVSS6.6AI score0.0062EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/12 11:22 p.m.15 views

CVE-2026-38812-RuoYi-SQL-Injection

ID de CVE CVE-2026-38812 Producto RuoYi Versión v4.8.2 Tipo de Problema Inyección SQL Descripción RuoYi v4.8.2 es vulnerable a Inyección SQL a través del endpoint /tool/gen/createTable...

9.8CVSS5.8AI score0.00393EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/12 4:56 p.m.7 views

RuoYI-4.2-Shiro-721-Docker-PoC

RuoYI 4.2 Shiro 1.4.1 Shiro-721 Entorno de reproducción de la vulnerabilidad Se utiliza para reproducir la vulnerabilidad Shiro-721 CVE-2019-12422 en RuoYI. Aviso: Este servicio contiene vulnerabilidades graves , solo para fines de reproducción de vulnerabilidades, no lo utilice en producción...

7.5CVSS7.4AI score0.09101EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 12:07 a.m.8 views

CVE-2024-57521-SQL-Injection-PoC

Inyección SQL Autenticada en RuoYi v4.7.9 Bypass de CVE-2024-42900 Introducción Descubrí una vulnerabilidad de Inyección SQL Ciega en la funcionalidad createTable de RuoYi Framework v4.7.9. Esto permite a un administrador autenticado ejecutar comandos SQL arbitrarios a través del parámetro sql...

10CVSS6.5AI score0.00668EPSS
SaveExploits4References1
Kitploit
Kitploit
added 2026/09/11 9:44 a.m.11 views

CVE-2026-52614

CVE-2026-52614 - RuoYi v4.8.3 Bypass de filterKeyword para Inyección SQL Chino | Inglés Se requiere autorización / Solo pruebas autorizadas Este repositorio está destinado únicamente a la investigación de seguridad y las pruebas autorizadas. No lo utilice contra sistemas sin permiso explícito. Es...

6.2AI score
SaveExploits1
EUVD
EUVD
added 2026/09/10 12:30 a.m.7 views

EUVD-2026-75208

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

5.8AI score0.00253EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/09 10:18 p.m.7 views

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

4.3CVSS0.00253EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/09 12:00 a.m.12 views

CVE-2026-71807

In RuoYi-Cloud-Plus versions up to 2.6.2 , the ruoyi-workflow module contains a broken access control vulnerability. Multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or a related user. As a...

4.3CVSS5.8AI score0.00253EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/09 12:00 a.m.31 views

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

0.00253EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/21 7:17 p.m.12 views

CVE-2026-77795

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

6.5CVSS0.00201EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/21 6:30 p.m.39 views

CVE-2026-77795 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

6.5CVSS0.00201EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/21 6:30 p.m.21 views

CVE-2026-77795

Dromara RuoYi-Vue-Plus (up to 5.6.2 ) is affected by an improper authorization vulnerability in the Workflow Endpoint component. The issue impacts the functions FlwInstanceController , FlwDefinitionController , FlwCategoryController , FlwSpelController , and TestLeaveController , allowing a remot...

6.5CVSS6.3AI score0.00201EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/21 6:30 p.m.121 views

EUVD-2026-64045

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

6.5CVSS6.3AI score0.00201EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/21 12:00 a.m.23 views

PT-2026-79431

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

6.5CVSS5.2AI score0.00201EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/19 9:17 p.m.12 views

CVE-2026-76576

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

5.3CVSS0.00365EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/19 8:15 p.m.36 views

CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

5.3CVSS0.00365EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/19 8:15 p.m.45 views

CVE-2026-76576

The CommonController.java fileDownload/resourceDownload function in RuoYi-Vue up to 3.9.2 allows remote path traversal via the fileName/resource argument. CVSS 4.3 (MEDIUM). A PoC exploit exists; the vendor has not responded. No patch version is provided in the documents.

5.3CVSS4.9AI score0.00365EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/19 8:15 p.m.51 views

CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...

5.3CVSS5.2AI score
SaveExploits0References8
Rows per page
Query Builder