Threat Intelligence Database

RuoYi version 4.8.2 contains a critical SQL Injection vulnerability in the /tool/gen/createTable endpoint within its code generation module. This flaw allows an authenticated attacker with administrative privileges to potentially access sensitive database information. The vulnerability is identified as CVE-2026-38812 and carries a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Ruoyi version 4.8.2 contains a Cross Site Scripting (XSS) vulnerability in the /system/notice/add interface. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser. The vulnerability has a medium severity rating with a CVSS score of 6.1. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monitor/job/ of the component Quartz Job Handler. Such manipulation of the argument invokeTarget leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityChinaUnited StatesIndia+7#cve#cve-2026-4564

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-70986

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope.

CriticalVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-70985

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-67342

Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-46175

Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the resetPwd Method of SysUserController.java.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-46174

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-56396

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/src/main/resources/application-druid.yml of the component Druid. The manipulation leads to use of default credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-7907