776 matches found
PT-2025-15253 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the SysDictTypeController component. Recommendations: For RUoYi version 4.8.0, consider disabling the SysDictTypeController component as a...
CVE-2025-28405
Summary: CVE-2025-28405 affects RUoYi v4.8.0 and allows a remote attacker to escalate privileges via the changeStatus method. The issue is exploitable over the network with no user interaction, and the base CVSSv3.1 score is 9.8 (CRITICAL) , with high impact on confidentiality, integrity, and ava...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which stems from the selectDeptTree method not properly validating the deptId parameter...
PT-2025-15248 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: The issue allows a remote attacker to escalate privileges. This is achieved via the selectDeptTree method of the "/selectDeptTree/deptId" endpoint, which does not properly validate the deptId parameter...
CVE-2025-28408
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...
CVE-2025-28408
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...
CVE-2025-28412
CVE-2025-28412 affects RUoYi v4.8.0. The issue enables a remote attacker to escalate privileges through the SysNoticeController.editSave method. Root cause details are not fully disclosed in the provided documents, but multiple sources confirm a privilege escalation vulnerability with a high/crit...
PT-2025-15252 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the "/editSave" method in SysNoticeController. Recommendations: For RUoYi version 4.8.0, as a temporary workaround, consider disabling the...
PT-2025-15249 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the add method of the "/add/parentId" endpoint, which does not properly validate whether the requesting user has permission to add a menu...
PT-2025-15250 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the cancelAuthUserAll method, which does not properly validate whether the requesting user has administrative privileges. Recommendations:...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which stems from the edit method not properly verifying the privileges of the requesting user, which could result in modifying the specified dictId...
CVE-2025-28409
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/parentId endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId...
CVE-2025-28407
CVE-2025-28407 affects RUoYi v4.8.0. A remote attacker can escalate privileges through the /edit/{dictId} endpoint due to insufficient permission validation on dictId modification. The CVE indicates high impact (CVSS 3.1: 8.8, Network/Low complexity, Privileges Required: Low, User Interaction: No...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi China. A security vulnerability exists in RuoYi v.4.8.0, which originates from the editSave method in tool/gen/editSave and may result in elevated privileges...
PT-2025-15247 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the edit method of the "/edit/dictId" endpoint, which does not properly validate whether the requesting user has permission to modify the...
RuoYi 安全漏洞
RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which can be exploited by a remote attacker to elevate privileges via the postID parameter...
PT-2025-15238 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the postID parameter in the edit method. Recommendations: For RUoYi version 4.8.0, consider disabling the edit method until a patch is...
CVE-2025-28402
Consolidated details: CVE-2025-28402 affects RUoYi v4.8.0 and allows a remote attacker to escalate privileges via the jobId parameter. Connected sources confirm the issue; no official patch/version fix is documented in the provided connected documents. PT-2025-15243 notes there is no information ...
CVE-2025-28407
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/dictId endpoint does not properly validate whether the requesting user has permission to modify the specified dictId...