CVE-2025-28408

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/deptId endpoint does not properly validate the deptId parameter...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi v.4.8.0, which stems from the selectDeptTree method not properly validating the deptId parameter...

CVE-2025-28408

The CVE-2025-28408 entry details a remote privilege-escalation in RUoYi v4.8.0 caused by the /selectDeptTree/{deptId} endpoint not properly validating the deptId parameter. This allows an attacker to escalate privileges without user interaction. The provided metrics cite CVSS v3.1: 9.8 (CRITICAL,...