Approved changes feed: RSS · Atom
cpe:2.3:a:y_project:ruoyi:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Y Project (08081fed-8406-51dd-828d-7888c7844a01) |
|---|---|
| Product | Ruoyi (c00a740f-f642-5f08-84e4-e993f1949d6b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-4819 |
vulnerable | 2026-06-08 07:29:17.340587 |
y_project RuoYi Offline Logout batchForceLogout improper authorization
LOW (3.1)
A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
Published: 2025-05-17T06:00:06.145Z
Updated: 2025-05-19T15:24:05.806Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0734 |
vulnerable | 2026-06-08 07:02:25.298564 |
y_project RuoYi Whitelist getBeanName deserialization
MEDIUM (4.7)
A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-01-27T19:00:12.136Z
Updated: 2025-02-12T20:01:11.854Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9048 |
vulnerable | 2026-06-08 07:00:26.554736 |
y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
LOW (3.1)
A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImpl of the file ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java of the component Backend User Import. The manipulation of the argument loginName leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The patch is named 9b68013b2af87b9c809c4637299abd929bc73510. It is recommended to apply a patch to fix this issue.
Published: 2024-09-21T08:31:19.316Z
Updated: 2024-09-23T15:51:04.588Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6511 |
vulnerable | 2026-06-08 06:58:19.641172 |
y_project RuoYi Content-Type isJsonRequest cross site scripting
LOW (3.5)
A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343.
Published: 2024-07-04T19:00:08.627Z
Updated: 2024-08-01T21:41:03.826Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-7133 |
vulnerable | 2026-06-08 06:21:57.105579 |
y_project RuoYi HTTP POST Request login cross site scripting
MEDIUM (4.3)
A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f0m<script>alert(1)</script>p86o0 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249136.
Published: 2023-12-28T17:31:04.010Z
Updated: 2024-08-02T08:50:08.284Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3815 |
vulnerable | 2026-06-08 06:09:40.594018 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3163 |
vulnerable | 2026-06-08 06:09:38.739901 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4566 |
vulnerable | 2026-06-08 05:51:59.768695 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.