CVE-2025-28408

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which stems from the selectDeptTree method not properly validating the deptId parameter...

CVE-2025-28408

The RUoYi v.4.8.0 backend management system is vulnerable to privilege escalation due to improper access control. The selectDeptTree method of the /selectDeptTree/{deptId} endpoint fails to properly validate the deptId parameter. As a temporary workaround, users are advised to restrict access to ...