RuoYi vulnerabilities

2 known vulnerabilities in RuoYi from Yangzongzhuan. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  RuoYi: Incorrect Privilege Assignment

  CVE-2025-10989Sep 26, 2025Yangzongzhuan

  A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This vulnerability affects unknown code of the file /system/role/authUser/selectAll. Performing manipulation of the argument userIds results in improper authorization. The attack can be in

• 9.8 Critical severity

  RuoYi: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-10473Sep 15, 2025Yangzongzhuan

  A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may b