ruoyi kayıtları
ruoyi üreticisine ait 59 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 4
- Düzeltme kaydı olan
- %3,4
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-284 Improper Access Control15
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')12
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6
- CWE-269 Improper Privilege Management3
- CWE-266 Incorrect Privilege Assignment3
- CWE-862 Missing Authorization2
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
59 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2023-49371İstismar yok | RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.ruoyi · ruoyi · CWE-89 | Kritik9,8 | — | %3,6 | 1 Ara 2023 |
40Planlayın | CVE-2024-57521Kavram kanıtı | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in Sruoyi · ruoyi · CWE-89 | Kritik10,0 | — | %0,6 | 23 Ara 2025 |
39İzleyin | CVE-2021-38241İstismar yok | Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework.ruoyi · ruoyi · CWE-502 | Kritik9,8 | — | %1,0 | 16 Ara 2022 |
39İzleyin | CVE-2021-28411İstismar yok | An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allowsruoyi · ruoyi · CWE-269 | Kritik9,8 | — | %0,9 | 11 Ağu 2023 |
39İzleyin | CVE-2022-4566İstismar yok | y_project RuoYi GenController sql injectionruoyi · ruoyi · CWE-707 | Kritik9,8 | — | %0,8 | 16 Ara 2022 |
39İzleyin | CVE-2022-48114İstismar yok | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.ruoyi · ruoyi · CWE-89 | Kritik9,8 | — | %0,8 | 2 Şub 2023 |
39İzleyin | CVE-2025-28410İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whetheruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28408İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28413İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController componentruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28412İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeControllerruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28406İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameterruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28411İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSaveruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28405İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus methodruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2025-28402İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameterruoyi · ruoyi · CWE-284 | Kritik9,8 | — | %0,6 | 7 Nis 2025 |
39İzleyin | CVE-2024-46076İstismar yok | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection ofruoyi · ruoyi · CWE-94 | Kritik9,8 | — | %0,5 | 7 Eki 2024 |
39İzleyin | CVE-2024-42913İstismar yok | RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.ruoyi · ruoyi · CWE-89 | Kritik9,8 | — | %0,3 | 26 Ağu 2024 |
36İzleyin | CVE-2025-70985İstismar yok | Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scruoyi · ruoyi · CWE-284 | Kritik9,1 | — | %0,4 | 23 Oca 2026 |
35İzleyin | CVE-2025-28407İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properruoyi · ruoyi · CWE-284 | Yüksek8,8 | — | %0,5 | 7 Nis 2025 |
35İzleyin | CVE-2025-28409İstismar yok | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properruoyi · ruoyi · CWE-284 | Yüksek8,8 | — | %0,5 | 7 Nis 2025 |
35İzleyin | CVE-2025-56396İstismar yok | An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tharuoyi · ruoyi · CWE-284 | Yüksek8,8 | — | %0,3 | 26 Kas 2025 |
31İzleyin | CVE-2022-23868İstismar yok | RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.ruoyi · ruoyi · CWE-1236 | Yüksek7,8 | — | %0,7 | 30 Mar 2022 |
30İzleyin | CVE-2023-3163Kavram kanıtı | y_project RuoYi filterKeyword resource consumptionruoyi · ruoyi · CWE-400 | Yüksek7,5 | — | %1,3 | 8 Haz 2023 |
30İzleyin | CVE-2024-29400İstismar yok | An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.ruoyi · ruoyi · CWE-200 | Yüksek7,5 | — | %0,6 | 12 Nis 2024 |
30İzleyin | CVE-2025-70986İstismar yok | Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive departmentruoyi · ruoyi · CWE-284 | Yüksek7,5 | — | %0,4 | 23 Oca 2026 |
30İzleyin | CVE-2023-27025İstismar yok | An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrarruoyi · ruoyi · CWE-494 | Yüksek7,5 | — | %0,3 | 1 Nis 2023 |
- CVE-2023-4937140Planlayın
RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
KritikCVSS 9,8İstismar yokEPSS %3ruoyi · ruoyi1 Ara 2023
- CVE-2024-5752140Planlayın
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in S
KritikCVSS 10,0Kavram kanıtıEPSS %0ruoyi · ruoyi23 Ara 2025
- CVE-2021-3824139İzleyin
Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework.
KritikCVSS 9,8İstismar yokEPSS %1ruoyi · ruoyi16 Ara 2022
- CVE-2021-2841139İzleyin
An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi11 Ağu 2023
- CVE-2022-456639İzleyin
y_project RuoYi GenController sql injection
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi16 Ara 2022
- CVE-2022-4811439İzleyin
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi2 Şub 2023
- CVE-2025-2841039İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whethe
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2840839İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endp
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2841339İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2841239İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2840639İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2841139İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2840539İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2840239İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2024-4607639İzleyin
RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi7 Eki 2024
- CVE-2024-4291339İzleyin
RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.
KritikCVSS 9,8İstismar yokEPSS %0ruoyi · ruoyi26 Ağu 2024
- CVE-2025-7098536İzleyin
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their sc
KritikCVSS 9,1İstismar yokEPSS %0ruoyi · ruoyi23 Oca 2026
- CVE-2025-2840735İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not proper
YüksekCVSS 8,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-2840935İzleyin
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not proper
YüksekCVSS 8,8İstismar yokEPSS %0ruoyi · ruoyi7 Nis 2025
- CVE-2025-5639635İzleyin
An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights tha
YüksekCVSS 8,8İstismar yokEPSS %0ruoyi · ruoyi26 Kas 2025
- CVE-2022-2386831İzleyin
RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.
YüksekCVSS 7,8İstismar yokEPSS %0ruoyi · ruoyi30 Mar 2022
- CVE-2023-316330İzleyin
y_project RuoYi filterKeyword resource consumption
YüksekCVSS 7,5Kavram kanıtıEPSS %1ruoyi · ruoyi8 Haz 2023
- CVE-2024-2940030İzleyin
An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.
YüksekCVSS 7,5İstismar yokEPSS %0ruoyi · ruoyi12 Nis 2024
- CVE-2025-7098630İzleyin
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department
YüksekCVSS 7,5İstismar yokEPSS %0ruoyi · ruoyi23 Oca 2026
- CVE-2023-2702530İzleyin
An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrar
YüksekCVSS 7,5İstismar yokEPSS %0ruoyi · ruoyi1 Nis 2023