Ruoyi Vue Pro
Approved changes feed: RSS · Atom
cpe:2.3:a:yunai:ruoyi-vue-pro:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Yunai (15548e9a-a0af-5de2-92d4-9496edb09476) |
|---|---|
| Product | Ruoyi Vue Pro (c6d8a6ae-c7f4-5a64-a0f7-35d7c02c86f7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57950 |
vulnerable | 2026-07-29 01:03:16.459141 |
ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController
HIGH (8.1)
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of the intended erp:sale-order namespace.
Published: 2026-06-29T17:20:07.371Z
Updated: 2026-07-14T21:34:40.853Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57949 |
vulnerable | 2026-07-29 01:03:16.458841 |
ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint
MEDIUM (6.5)
ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.
Published: 2026-06-29T17:19:39.261Z
Updated: 2026-07-14T21:34:40.162Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.