Ruoyi 授权问题漏洞

Ruoyi is a backend management system for Ruoyi's individual developers. An authorization issue vulnerability exists in Ruoyi version 4.8.1 and prior versions, which stems from an incorrect operation of the parameter userIds in the file /system/role/authUser/selectAll, which may result in improper...

ruoyi-vue-pro 授权问题漏洞

ruoyi-vue-pro is China's taro source code zhijiantianya open source an optimized refactoring of efficient backend management system framework for the development of enterprise backend , SaaS platforms , WeChat small program backend and so on. ruoyi-vue-pro 2025.09 and previous versions of the...

PT-2025-39467

Name of the Vulnerable Software and Affected Versions YunaiV ruoyi-vue-pro versions up to 2025.09 Description A flaw exists in YunaiV ruoyi-vue-pro up to version 2025.09, related to improper authorization. The issue is located in an unspecified part of the /crm/business/transfer file and can be...

PT-2025-39468

Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi versions up to 4.8.1 Description A security flaw exists in yangzongzhuan RuoYi. The issue involves improper authorization due to manipulation of the userIds argument in the file '/system/role/authUser/selectAll'. This allow...

CVE-2025-10473

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has...

RuoYi License Issue Vulnerability

RuoYi is a backend management system for individual developers in China RuoYi RuoYi. RuoYi 4.8.1 and previous versions of the authorization problem vulnerability, the vulnerability stems from the file / system / role / authUser / cancelAll in the parameter roleId and userIds there is improper...

CVE-2025-10384

A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAll of the component Role Handler. Executing manipulation of the argument roleId/userIds can lead to improper authorization. The attack may ...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the filterKeyword function of the Blacklist Handler process in /com/ruoyi/generator/controller. An attacker can access or modify sensitive data, or disrupt application functionality by injecting malicious SQL statements...

CVE-2025-10473

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has...

CVE-2025-10473

CVE-2025-10473 affects yangzongzhuan RuoYi up to version 4.8.1. The vulnerability resides in the Blacklist Handler’s function filterKeyword within SqlUtil.java , enabling SQL injection. The issue can be exploited remotely and an exploit has been released publicly. Affected component is the Blackl...

CVE-2025-10473 yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has...

CVE-2025-10473 yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has...

CVE-2025-10473 yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has...

PT-2025-37740

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A security flaw has been discovered in yangzongzhuan RuoYi. This impacts the filterKeyword function of the file /com/ruoyi/common/utils/sql/SqlUtil.java within the Blacklist Handler...

RuoYi SQL注入漏洞

RuoYi is a backend management system by the individual developer of RuoYi in China. A SQL injection vulnerability exists in RuoYi 4.8.1 and earlier versions. The vulnerability stems from improper manipulation of the Blacklist Handler's function filterKeyword in the file...

CVE-2025-10278

A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and...

CVE-2025-10276

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The...

fcba_zzm ics-park 代码注入漏洞

fcbazzm ics-park is a smart park management system from fcbazzm. A code injection vulnerability exists in fcbazzm ics-park version 2.0, which originates from a flaw in an unknown function in the file ruoyi-quartz/src/main/java/com/ruoyi/quartz/controller/JobController.java, which could lead to a...

CVE-2025-10384

A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAll of the component Role Handler. Executing manipulation of the argument roleId/userIds can lead to improper authorization. The attack may ...

CVE-2025-10384

A vulnerability (CVE-2025-10384) affects yangzongzhuan RuoYi up to version 4.8.1, specifically the Role Handler’s endpoint /system/role/authUser/cancelAll. The issue arises from improper authorization when manipulating the arguments roleId or userIds, allowing remote exploitation. Multiple feeds ...