CVE-2026-108803

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

CVE-2026-108803

A security vulnerability exists in y_project RuoYi versions up to 4.8.3 . The flaw specifically impacts the changeStatus function within the /system/config/add file of the Disable API component. This vulnerability, categorized under CWE-613 (Insufficient Session Expiration) , allows an attacker t...

CVE-2026-108803 y_project RuoYi Disable API add changeStatus session expiration

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

EUVD-2026-97237

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

CVE-2026-40099 Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint site/blueprints/users/.... It is also possible to customize th...

EUVD-2025-10354

Malicious code in bioql PyPI...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which can be exploited by a remote attacker to elevate privileges via the changeStatus method...

CVE-2025-28405

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method...

CVE-2025-28405: Improper Access Control

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method...

CVE-2025-28405

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method...

CVE-2025-28405

The backend management system RUoYi v.4.8.0 contains an improper access control vulnerability (CWE-284) within the changeStatus method. A remote attacker can exploit this issue to perform privilege escalation . As a mitigation, it is recommended to disable the changeStatus method until a formal p...

CVE-2023-48020

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/task/changeStatus...

CVE-2023-48020

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/task/changeStatus...

CVE-2023-48020: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/task/changeStatus...

CVE-2023-48020

Summary: CVE-2023-48020 affects Dreamer CMS 4.1.3 with a CSRF vulnerability exploitable via /admin/task/changeStatus. The CVSS 3.1 base score is 8.8 (High) with PR:None, UI:Required, and impacts to confidentiality, integrity, and availability (all High). Connected sources confirm the same vector ...

Dreamer CMS Security Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version v4.1.3, which stems from a cross-site request forgery CSRF vulnerability via /admin/task/changeStatus...

CVE-2022-40030

SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php...

Simple Task Managing System SQL注入漏洞

Simple Task Managing System is a simple task management system. A security vulnerability exists in version v1.0 of Simple Task Managing System due to an SQL injection vulnerability in the bookId parameter of the changeStatus.php component...