CVE-2026-122016Medium· 6.3▾ SunlitA vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
RuoYi-Vue 3.9.0RuoYi-Vue 3.9.1RuoYi-Vue 3.9.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108825Medium· 5.4A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3
CVE-2026-121514Medium· 6.3EasySoft ZenTao PMS User model.php checkGroupChange privileges management
CVE-2026-120185Medium· 4.7ken678 YznCMS Auth Group Group.php Backend privileges management
CVE-2026-116471Medium· 4.3BKWLD Decoy Authorization Policy Policy.php privileges management
CVE-2026-116223Medium· 6.5icret EasyImage del.php privileges management
CVE-2026-109143Medium· 5.4A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0