GCVE - cpe:2.3:a:lostvip-com:ruoyi-go:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lostvip-com:ruoyi-go:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Lostvip Com (`8705b05e-63f9-514d-ba8c-2ccb4911119f`)
Product	Ruoyi Go (`69b8630e-84a9-5075-80cb-538d4ceecde0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9413`	vulnerable	2026-06-08 07:45:22.441388	lostvip-com ruoyi-go system_router.go SelectListByPage sql injection MEDIUM (6.3) A flaw has been found in lostvip-com ruoyi-go up to 2.1. This impacts the function SelectListByPage of the file modules/system/system_router.go. This manipulation of the argument orderByColumn/isAsc causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T18:02:08.185Z Updated: 2025-08-25T18:09:50.560Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321254 https://vuldb.com/?ctiid.321254 https://vuldb.com/?submit.633730 https://vuldb.com/?submit.633731 https://github.com/on-theway/cve/issues/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9412`	vulnerable	2026-06-08 07:45:22.441010	lostvip-com ruoyi-go DictDataDao.go SelectListByPage sql injection MEDIUM (6.3) A vulnerability was detected in lostvip-com ruoyi-go up to 2.1. This affects the function SelectListByPage of the file modules/system/dao/DictDataDao.go. The manipulation of the argument orderByColumn/isAsc results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T17:32:07.046Z Updated: 2025-08-25T20:37:18.379Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321253 https://vuldb.com/?ctiid.321253 https://vuldb.com/?submit.633704 https://vuldb.com/?submit.633705 https://github.com/on-theway/cve/issues/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9411`	vulnerable	2026-06-08 07:45:22.440622	lostvip-com ruoyi-go LoginInforService.go SelectPageList sql injection MEDIUM (6.3) A security vulnerability has been detected in lostvip-com ruoyi-go up to 2.1. The impacted element is the function SelectPageList of the file modules/system/service/LoginInforService.go. The manipulation of the argument isAsc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T17:02:06.294Z Updated: 2025-08-25T20:36:42.402Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321252 https://vuldb.com/?ctiid.321252 https://vuldb.com/?submit.633688 https://github.com/on-theway/cve/issues/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9410`	vulnerable	2026-06-08 07:45:22.440093	lostvip-com ruoyi-go GenTableDao.go SelectListByPage sql injection MEDIUM (6.3) A weakness has been identified in lostvip-com ruoyi-go up to 2.1. The affected element is the function SelectListByPage of the file modules/system/dao/GenTableDao.go. Executing manipulation of the argument isAsc/orderByColumn can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T16:32:06.462Z Updated: 2025-08-25T20:34:45.643Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321251 https://vuldb.com/?ctiid.321251 https://vuldb.com/?submit.633677 https://vuldb.com/?submit.633679 https://github.com/on-theway/cve/issues/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9409`	vulnerable	2026-06-08 07:45:22.438648	lostvip-com ruoyi-go CommonController.go DownloadUpload path traversal MEDIUM (4.3) A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controller/CommonController.go. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T16:02:07.354Z Updated: 2025-08-25T20:31:50.515Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321250 https://vuldb.com/?ctiid.321250 https://vuldb.com/?submit.633661 https://vuldb.com/?submit.633663 https://github.com/on-theway/cve/issues/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10218`	vulnerable	2026-06-08 07:02:26.462628	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Ruoyi Go

Notes

PURL mappings

Vulnerability references

Contribute