PT-2025-3443 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: The issue allows unauthorized attackers to view the session ID of the admin in the system monitoring, enabling them to impersonate Admin users via a crafted cookie. Recommendations: RuoYi version 4.8.0: Update...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi version v4.8.0, which originates from allowing an unauthorized attacker to view an administrator's session ID in System Monitor...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.8.0, which stems from the presence of an insecure privilege that allows an authenticated attacker to elevate privileges by assigning himself a higher-level role...

CVE-2024-57437

RuoYi (software) v4.8.0 contains a SQL injection vulnerability in the /monitor/online/list endpoint, exploitable via the orderby parameter. The CVE-2024-57437 entry lists a CVSS v3.1 base score of 6.5 (MEDIUM) with Network attack vector, low attack complexity, and privileges required. The impact ...

PT-2025-3444 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: A SQL injection issue was found in RuoYi via the orderby parameter at the "/monitor/online/list" API endpoint. Recommendations: For RuoYi version 4.8.0, as a temporary workaround, consider restricting access t...

CVE-2024-57436

RuoYi v4.8.0 contains an exposure in the system monitoring session handling where an unauthenticated user could view the admin session ID via a crafted cookie, enabling admin impersonation. The issue is documented across multiple sources (CVE-2024-57436) and is classified with high impact (confid...

CVE-2024-57439

CVE-2024-57439 affects Ruoyi v4.8.0. The vulnerability resides in the reset password interface, where attackers with Admin privileges can trigger a Denial of Service by duplicating the login name of an account. Affected component is the reset-password flow; root cause and exact code path are not ...

CVE-2024-57436

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie...

CVE-2024-57438

Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...

CVE-2024-57437

RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...

CVE-2024-57437

RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...

PT-2025-3445 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RuoYi version 4.8.0 Description: The issue concerns insecure permissions that allow authenticated attackers to escalate privileges by assigning themselves higher level roles. Recommendations: For RuoYi version 4.8.0, update the permissions to...

CVE-2024-57438

Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...

CVE-2024-57438

Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.8.0, which stems from a problem with the reset password screen that allows an attacker with administrator privileges to cause a denial of service by copying the login name...

CVE-2024-57439

An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service DoS by duplicating the login name of the account...

CVE-2024-57437

RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list...

CVE-2025-0734

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...

CVE-2025-0734 y_project RuoYi Whitelist getBeanName deserialization

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...

CVE-2025-0734 y_project RuoYi Whitelist getBeanName deserialization

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...