RuoYi vulnerabilities
CVEs whose affected-version data names the RuoYi package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-108825Medium· 5.4PoCA vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3
A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is…
CVE-2026-108803Medium· 6.3A security vulnerability has been detected in y_project RuoYi up to 4.8.3
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible t…
CVE-2026-108802Low· 3.5PoCA weakness has been identified in y_project RuoYi up to 4.8.3
A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass ca…
CVE-2026-108800Medium· 4.3PoCA vulnerability was identified in yangzongzhuan RuoYi 4.8.3
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about th…
CVE-2025-67342Medium· 4.6RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared acro…
CVE-2025-10989Medium· 6.3A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorizatio…