CVE-2024-46076

RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code...

CVE-2024-46076

RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code...

CVE-2024-46076

CVE-2024-46076 affects RuoYi v4.7.9 and earlier. The flaw allows escaping from comments inside the code generation feature, enabling injection of malicious code. The connected sources consistently state affected versions and the code-generation comment-escape issue; no remediation details are pro...

CVE-2024-46076

RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code...

CVE-2024-42900

Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting XSS vulnerability via the sql parameter of the createTable function at /tool/gen/create...

CVE-2024-42900

CVE-2024-42900 affects Ruoyi v4.7.9 and earlier, where a cross-site scripting (XSS) vulnerability exists via the sql parameter to the createTable() function at /tool/gen/create. The issue is documented across multiple sources (Red Hat, NVD/NVD mirrors, CVE lists) with the same description. Affect...

CVE-2024-42900

Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting XSS vulnerability via the sql parameter of the createTable function at /tool/gen/create...

CVE-2024-42913

RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the jobid parameter at /sasfs1...

CVE-2024-42913

RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the jobid parameter at /sasfs1...

CVE-2024-42913

RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the jobid parameter at /sasfs1...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."...

CVE-2020-18195

Pluck CMS v4.7.9 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows remote attackers to execute arbitrary code and delete a specific article via the component /admin.php?action=page. Root cause is CSRF in the admin flow. No exploit vectors, practical exploit details, or ...

CVE-2018-13999

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...

CVE-2018-13999

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...