CVE-2026-116006High· 7.3▾ MidnightPoC availableA vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
0.4% → 0.8%
Nuclei ×1
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
ruoyi-vue-pro 2026.09ruoyi-vue-pro 2026.09Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7679High· 7.3YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
CVE-2026-7710High· 7.3YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-10276Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-2708Medium· 5.4zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal
CVE-2025-2707Medium· 5.4zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal