Ruoyi vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-70986 Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.High 7.5 · Jan 23, 2026
• CVE-2025-70985 Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.Critical 9.1 · Jan 23, 2026
• CVE-2024-57521 SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.Critical 10 · Dec 23, 2025
• CVE-2025-46175 Ruoyi v4.8.0 is vulnerable to Incorrect Access Control.High 7.5 · Nov 26, 2025
• CVE-2025-56396 An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.High 8.8 · Nov 26, 2025
• CVE-2025-46174 Ruoyi v4.8.0 vulnerable to Incorrect Access Control.High 7.5 · Nov 26, 2025
• CVE-2025-28413 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController componentCritical 9.8 · Apr 7, 2025
• CVE-2025-28412 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeControllerCritical 9.8 · Apr 7, 2025
• CVE-2025-28411 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSaveCritical 9.8 · Apr 7, 2025
• CVE-2025-28410 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting useCritical 9.8 · Apr 7, 2025
• CVE-2025-28409 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether High 8.8 · Apr 7, 2025
• CVE-2025-28408 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properCritical 9.8 · Apr 7, 2025
• CVE-2025-28407 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether High 8.8 · Apr 7, 2025
• CVE-2025-28406 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameterCritical 9.8 · Apr 7, 2025
• CVE-2025-28405 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus methodCritical 9.8 · Apr 7, 2025
• CVE-2025-28403 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has admHigh 7.2 · Apr 7, 2025
• CVE-2025-28402 An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameterCritical 9.8 · Apr 7, 2025
• CVE-2024-57436 RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring.High 7.2 · Jan 29, 2025
• CVE-2024-46076 RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code.Critical 9.8 · Oct 7, 2024
• CVE-2024-42913 RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.Critical 9.8 · Aug 26, 2024
• CVE-2024-29400 An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.High 7.5 · Apr 12, 2024
• CVE-2023-49371 RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.Critical 9.8 · Dec 1, 2023
• CVE-2021-28411 An issue was discovered in getRememberedSerializedIdentity function in CookieRememberMeManager class in lerry903 RuoYi version 3.4.0, allows remote attackers toCritical 9.8 · Aug 11, 2023
• CVE-2023-27025 An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the serveHigh 7.5 · Apr 1, 2023
• CVE-2022-48114 RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.Critical 9.8 · Feb 2, 2023