789 matches found
CVE-2025-2040 zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack ca...
CVE-2025-2040
CVE-2025-2040 affects zhijiantianya ruoyi-vue-pro 2.4.1. The vulnerability involves an unknown functionality at the file path /admin-api/bpm/model/deploy where improper neutralization of special elements in a template engine can be exploited. It is exploitable remotely and, per sources, the explo...
ruoyi-vue-pro 安全漏洞
ruoyi-vue-pro is a Taro Road source code zhijiantianya open source an optimized and refactored efficient backend management system framework for the development of enterprise backend , SaaS platform , WeChat small program backend and so on. ruoyi-vue-pro 2.4.1 version of a security vulnerability ...
RuoYi vulnerable to Denial of Service by attackers with admin privileges
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
RuoYi has insecure permissions
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...
RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
GHSA-H5JH-RP76-Q242 RuoYi has insecure permissions
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...
GHSA-V664-QGX9-WF79 RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
GHSA-QQ5H-RJJ9-Q9QG RuoYi vulnerable to Denial of Service by attackers with admin privileges
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
CVE-2024-57436
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
CVE-2024-57439
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
CVE-2024-57438
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...
CVE-2024-57437
RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...
RuoYi 安全漏洞
RuoYi is a backend management system by the individual developer RuoYi in China. A security vulnerability exists in RuoYi v4.8.0, which is caused by an SQL injection via the orderby parameter in /monitor/online/list...
CVE-2024-57439
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...
CVE-2024-57436
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
CVE-2024-57438
The CVE-2024-57438 entry concerns insecure permissions in RuoYi v4.8.0 that allow an authenticated attacker to escalate privileges by self-assigning higher-level roles. Affected component: RuoYi core authorization/role-assignment mechanism; root cause is insecure permission controls enabling priv...
CVE-2024-57436
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...
PT-2025-3446 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: ruoyi version 4.8.0 Description: The issue is related to the reset password interface, where attackers with Admin privileges can cause a Denial of Service DoS by duplicating the login name of the account. Recommendations: ruoyi version 4.8.0:...