Product by Yangzongzhuan
RuoYi
13 known vulnerabilities in RuoYi (Yangzongzhuan), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2025-7901 | yangzongzhuan RuoYi Swagger UI index.html cross site scripting | 4.3 | |
| Medium | CVE-2026-108825 | yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management | 5.4 | |
| Medium | CVE-2026-108800 | yangzongzhuan RuoYi cross-site request forgery | 4.3 | |
| Medium | CVE-2026-129247 | yangzongzhuan RuoYi Code Generator VelocityUtils.java VelocityUtils.getFileName path traversal | 4.7 | |
| High | CVE-2025-10989 | yangzongzhuan RuoYi selectAll improper authorization | 6.3 | |
| Critical | CVE-2025-10473 | yangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injection | 6.3 | |
| Medium | CVE-2025-7907 | yangzongzhuan RuoYi Druid application-druid.yml default credentials | 4.3 | |
| Medium | CVE-2025-7906 | yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload | 6.3 | |
| Medium | CVE-2026-4564 | yangzongzhuan RuoYi Quartz Job job code injection | 4.7 | |
| Medium | CVE-2025-10384 | yangzongzhuan RuoYi Role cancelAll improper authorization | 5.4 | |
| Medium | CVE-2025-8847 | yangzongzhuan RuoYi edit cross site scripting | 3.5 | |
| Medium | CVE-2025-7902 | yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting | 3.5 | |
| Medium | CVE-2025-7903 | yangzongzhuan RuoYi Image Source ui layer | 4.3 |