Dromara records

7 published records for vendor dromara.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 42.9%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-44794No exploit	An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.dromara · sa-token · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	1.3%	Oct 25, 2023
39Monitor	CVE-2023-31581No exploit	Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.dromara · sureness · CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	1.0%	Oct 25, 2023
37Monitor	CVE-2025-66916No exploit	The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpredromara · ruoyi-vue-plus · CWE-94 pre-auth RCE	Critical9.4	—	0.7%	Jan 8, 2026
35Monitor	CVE-2023-43961No exploit	An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authdromara · sa-token · CWE-863 Auth bypass Broken access control (IDOR)	High8.8	—	1.0%	Oct 25, 2023
30Monitor	CVE-2023-3276No exploit	Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity referencedromara · hutool · CWE-611 Pre-auth XXE	High7.5	—	0.7%	Jun 15, 2023
22Monitor	CVE-2025-6925No exploit	Dromara RuoYi-Vue-Plus Mail MailController.java path traversaldromara · ruoyi-vue-plus · CWE-22 Pre-auth Path traversal	Medium5.5	—	1.0%	Jun 30, 2025
17Monitor	CVE-2024-3928No exploit	Dromara open-capacity-platform auth-server heapdump information disclosuredromara · open-capacity-platform · CWE-200 Info leak	Medium4.3	—	0.5%	Apr 17, 2024

CVE-2023-44794
39Monitor
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
dromara · sa-tokenOct 25, 2023
CVE-2023-31581
39Monitor
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Hard-coded credentials
dromara · surenessOct 25, 2023
CVE-2025-66916
37Monitor
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpre
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
dromara · ruoyi-vue-plusJan 8, 2026
CVE-2023-43961
35Monitor
An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an auth
HighCVSS 8.8No exploitEPSS 1%
- Auth bypass
- Broken access control (IDOR)
dromara · sa-tokenOct 25, 2023
CVE-2023-3276
30Monitor
Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XXE
dromara · hutoolJun 15, 2023
CVE-2025-6925
22Monitor
Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
MediumCVSS 5.5No exploitEPSS 1%
- Pre-auth
- Path traversal
dromara · ruoyi-vue-plusJun 30, 2025
CVE-2024-3928
17Monitor
Dromara open-capacity-platform auth-server heapdump information disclosure
MediumCVSS 4.3No exploitEPSS 0%
- Info leak
dromara · open-capacity-platformApr 17, 2024