CVE-2025-7906 yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The...

CVE-2025-7906

CVE-2025-7906 affects RuoYi up to version 4.8.1. The vulnerability is in the uploadFile function (ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java) where manipulating the File argument enables unrestricted file upload. The issue can be triggered remotely and the exp...

CVE-2025-7903

A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The...

CVE-2025-7903 yangzongzhuan RuoYi Image Source ui layer

A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The...

CVE-2025-7903

CVE-2025-7903 affects yangzongzhuan RuoYi up to version 4.8.1. The vulnerability lies in the Image Source Handler component, causing improper restriction of rendered UI layers. It is exploitable remotely and the exploit has been publicly disclosed. Remediation per PT-Security and Red Hat advisori...

CVE-2025-7903 yangzongzhuan RuoYi Image Source ui layer

A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The...

CVE-2025-7903 yangzongzhuan RuoYi Image Source ui layer

A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The...

CVE-2025-7901

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...

CVE-2025-7902

A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2025-7902 yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting

A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2025-7902

CVE-2025-7902 affects YangZongZhuan RuoYi up to version 4.8.1. The vulnerability is in the function addSave of file com/ruoyi/web/controller/system/SysNoticeController.java , causing a cross-site scripting (XSS) issue. It can be triggered remotely and exploitation details have been disclosed publ...

CVE-2025-7902 yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting

A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2025-7902 yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting

A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2025-7901 yangzongzhuan RuoYi Swagger UI index.html cross site scripting

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...

CVE-2025-7901 yangzongzhuan RuoYi Swagger UI index.html cross site scripting

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...

CVE-2025-7901 yangzongzhuan RuoYi Swagger UI index.html cross site scripting

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...

CVE-2025-7901

Summary (CVE-2025-7901) : The vulnerability affects yangzongzhuan RuoYi versions up to 4.8.1, specifically in the Swagger UI component accessed via /swagger-ui/index.html. The root cause is manipulation of the configUrl parameter in Swagger UI, which can lead to cross‑site scripting. The issue ma...

PT-2025-30208 · Yangzongzhuan · Ruoyi

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A problematic issue exists in yangzongzhuan RuoYi, specifically within the Image Source Handler component. This issue involves improper restriction of rendered UI layers and can be exploit...

RuoYi 安全漏洞

RuoYi is a backend management system by the individual developer of RuoYi in China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which stems from an improper restriction of the rendering UI layer of the Image Source Handler component...

PT-2025-30207 · Yangzongzhuan · Ruoyi

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A cross-site scripting issue exists due to the addSave function within the com/ruoyi/web/controller/system/SysNoticeController.java file. This allows for remote attacks. The exploit detail...