Ruoyi Vue Pro
Monthly
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Path traversal in the ruoyi-vue-pro file upload endpoint exposes unauthenticated remote attackers to arbitrary file read and write operations via the `generateUploadPath` function in `FileServiceImpl.java`. All versions up to 2026.04-jdk8-SNAPSHOT are confirmed affected across both the YunaiV (GitHub) and zhijiantianya (Gitee) vendor distributions. Publicly available exploit code exists via GitHub issue #1146; no CISA KEV listing is present, but the unauthenticated network vector combined with a public proof-of-concept materially elevates operational risk above the CVSS 4.0 base score of 6.9 alone.
A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RuoYi v3.8.3 has a Weak password vulnerability in the management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Path traversal in the ruoyi-vue-pro file upload endpoint exposes unauthenticated remote attackers to arbitrary file read and write operations via the `generateUploadPath` function in `FileServiceImpl.java`. All versions up to 2026.04-jdk8-SNAPSHOT are confirmed affected across both the YunaiV (GitHub) and zhijiantianya (Gitee) vendor distributions. Publicly available exploit code exists via GitHub issue #1146; no CISA KEV listing is present, but the unauthenticated network vector combined with a public proof-of-concept materially elevates operational risk above the CVSS 4.0 base score of 6.9 alone.
A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
RuoYi v3.8.3 has a Weak password vulnerability in the management system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.