CVE-2026-108803

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

EUVD-2026-97237

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

CVE-2026-108803 y_project RuoYi Disable API add changeStatus session expiration

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

CVE-2026-108803

A security vulnerability exists in y_project RuoYi versions up to 4.8.3 . The flaw specifically impacts the changeStatus function within the /system/config/add file of the Disable API component. This vulnerability, categorized under CWE-613 (Insufficient Session Expiration) , allows an attacker t...

EUVD-2026-97234

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-108802

A cross-site scripting (XSS) vulnerability exists in y_project RuoYi (up to version 4.8.3 ) within the Dictionary Data Drawer Preview component. The flaw is located in the renderDrawer function of the /system/dict/data/add file, where a lack of proper input validation on the cssClass argument all...

CVE-2026-108802 y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-108802: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2026-108803: Insufficient Session Expiration

A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...

EUVD-2025-204020

A security vulnerability has been detected in yproject RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed public...

CVE-2025-14856 y_project RuoYi getnames code injection

A security vulnerability has been detected in yproject RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed public...

EUVD-2023-2107

Malicious code in bioql PyPI...

CVE-2025-0734

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...

CVE-2025-4819 y_project RuoYi Offline Logout batchForceLogout improper authorization

A vulnerability classified as problematic has been found in yproject RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack...

CVE-2025-4819 y_project RuoYi Offline Logout batchForceLogout improper authorization

A vulnerability classified as problematic has been found in yproject RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack...

CVE-2025-4819: Improper Authorization

A vulnerability classified as problematic has been found in yproject RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack...

CVE-2025-0734 y_project RuoYi Whitelist getBeanName deserialization

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...

CVE-2025-0734: Deserialization of Untrusted Data

A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...

CVE-2024-9048

A vulnerability was found in yproject RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImpl of the file ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java of the component Backend User Import. The...

CVE-2024-9048 y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting

A vulnerability was found in yproject RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImpl of the file ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java of the component Backend User Import. The...