785 matches found
CVE-2026-38812-RuoYi-SQL-Injection
ID de CVE CVE-2026-38812 Producto RuoYi Versión v4.8.2 Tipo de Problema Inyección SQL Descripción RuoYi v4.8.2 es vulnerable a Inyección SQL a través del endpoint /tool/gen/createTable...
RuoYI-4.2-Shiro-721-Docker-PoC
RuoYI 4.2 Shiro 1.4.1 Shiro-721 Vulnerability Reproduction Environment Used to reproduce the Shiro-721 vulnerability CVE-2019-12422 on RuoYI. Note: This service contains critical vulnerabilities and is intended only for vulnerability reproduction purposes. Do not use in production environments...
CVE-2024-57521-SQL-Injection-PoC
Inyección SQL Autenticada en RuoYi v4.7.9 Bypass de CVE-2024-42900 Introducción Descubrí una vulnerabilidad de Inyección SQL Ciega en la funcionalidad createTable de RuoYi Framework v4.7.9. Esto permite a un administrador autenticado ejecutar comandos SQL arbitrarios a través del parámetro sql...
CVE-2026-52614
CVE-2026-52614 - RuoYi v4.8.3 Bypass de filterKeyword para Inyección SQL Chino | Inglés Se requiere autorización / Solo pruebas autorizadas Este repositorio está destinado únicamente a la investigación de seguridad y las pruebas autorizadas. No lo utilice contra sistemas sin permiso explícito. Es...
EUVD-2026-75208
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
CVE-2026-71807
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
CVE-2026-71807
RuoYi-Cloud-Plus versions up to 2.6.2 are affected in the ruoyi-workflow module. The root cause is that multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or related user. Authenticated low-p...
CVE-2026-77795
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...
CVE-2026-77795 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...
CVE-2026-77795
Dromara RuoYi-Vue-Plus (up to 5.6.2 ) is affected by an improper authorization vulnerability in the Workflow Endpoint component. The issue impacts the functions FlwInstanceController , FlwDefinitionController , FlwCategoryController , FlwSpelController , and TestLeaveController , allowing a remot...
EUVD-2026-64045
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...
PT-2026-79431
A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...
CVE-2026-76576
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
CVE-2026-76576
The CommonController.java fileDownload/resourceDownload function in RuoYi-Vue up to 3.9.2 allows remote path traversal via the fileName/resource argument. CVSS 4.3 (MEDIUM). A PoC exploit exists; the vendor has not responded. No patch version is provided in the documents.
CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
EUVD-2026-62846
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
PT-2026-78683
Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi-Vue versions prior to 3.9.3 Description A path traversal issue exists in the Common Download Endpoint within the fileDownload and resourceDownload functions of the CommonController.java file. A remote attacker can manipulat...
📄 ICS-Park Smart Park Management System 2.0 Privilege Escalation
A proof of concept exploit for a privilege escalation vulnerability in ICS-Park Smart Park Management System version 2.0. Missing authorization checks allow an authenticated low-privileged user to create a role containing arbitrary permissions, assign that role to their own account, and create ne...
