CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

Cross site request forgery (csrf)

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

Input validation

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

CVE-2022-23869

In RuoYi v4.7.2 WebUI, there is a privilege-check bypass in password reset: user test1 cannot reset test3’s password per permissions, yet the /system/user/resetPwd endpoint can reset test3’s password, enabling unauthorized password-reset actions.

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...

CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

CVE-2022-23868

CVE-2022-23868 affects RuoYi v4.7.2 via the ruoyi-admin interface, describing a CSV injection vulnerability when a victim opens an .xlsx log file. The connected Red Hat entry corroborates the same product/version. CVSS‑3.1 base score is 7.8 (HIGH) with LOCAL attack, user interaction required, and...

CVE-2022-23868

RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.7.2, which originates from the fact that in the RuoYi v4.7.2 interface, the user test1 does not have the privilege to reset the password of the user test3, but can request...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v4.7.2, there is no information about the vulnerability at the moment, please keep an eye on CNNVD or the vendor's announcement...

SQL Injection Vulnerability in Ruoyi Management System (CNVD-2021-39812)

Ruoyi management system is based on SpringBoot2.0 rights management system . A SQL injection vulnerability exists in Ruoyi Management System, which can be exploited by an attacker to obtain sensitive information from the database...

SQL Injection Vulnerability in Ruoyi Management System (CNVD-2021-36506)

Ruoyi management system is based on SpringBoot2.0 permissions management system, the core technology using SpringBoot, MyBatis, Shiro, Thymeleaf, Bootstrap, Vue and so on. The system suffers from a SQL injection vulnerability, which can be exploited by an attacker to obtain sensitive information...

If a deserialization vulnerability exists in CMS

Ruoyi CMS is a set of domestic SpringBoot-based rights management system . Ruoyi CMS has a deserialization vulnerability that can be exploited by an attacker to deserialize arbitrary code execution by sending a JNDI request...

SQL Injection Vulnerability in Ruoyi Management System

Ruoyi management system is based on SpringBoot2.0 permissions management system, the core technology using SpringBoot, MyBatis, Shiro, Thymeleaf, Bootstrap, Vue and so on. The system suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information fr...

Arbitrary File Download Vulnerability in Ruoyi Management System

Ruoyi management system is a SpringBoot2.0 based on the use of Spring, MyBatis, Shiro rights management system . Ruoyi Management System has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

Unauthorized access and file upload vulnerabilities in Ruoyi's backend management system

Ruoyi backend management system is based on SpringBoot, Spring Security, JWT, Vue & Element of the front and back end separation of permissions management system , can be used for all Web applications , such as website management backend , website member center , CMS, CRM, OA and so on. If there ...

Weak password vulnerability in Ruoyi management system (CNVD-2020-28783)

Ruoyi management system is a SpringBoot2.0 based on the use of Spring, MyBatis, Shiro rights management system . Ruoyi Management System has a weak password vulnerability that can be exploited by an attacker to log in to the system via a weak password and obtain sensitive information on the websi...

Logic flaw vulnerability in Ruoyi's backend management system

Ruoyi backend management system is based on SpringBoot2.0 rights management system . A logic flaw vulnerability exists in the Ruoyi Backend Management System. An attacker can view the source code to obtain a username and password to log in to the backend...