Skip to content
OpenAdvisories

Vendor

y_project

12 known vulnerabilities.

y_project at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 2 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202620
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202510
Apr 202500
Mar 202500
Feb 202500
Jan 202510
Dec 202400

Products

RuoYi 11 RuoYi-Cloud 1
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Medium 6.3
    CVE-2026-108803

    y_project RuoYi Disable API add changeStatus session expiration

    A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack …

    y_project RuoYi
  • Low 3.5
    CVE-2026-108802

    y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting

    A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site s…

    y_project RuoYi
  • Medium 6.3
    CVE-2025-14856

    y_project RuoYi getnames code injection

    A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely…

    y_project RuoYi
  • Low 3.1
    CVE-2025-4819

    y_project RuoYi Offline Logout batchForceLogout improper authorization

    A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorizati…

    y_project RuoYi
  • Medium 4.7
    CVE-2025-0734

    y_project RuoYi Whitelist getBeanName deserialization

    A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The expl…

    y_project RuoYi
  • Low 3.1
    CVE-2024-9048

    y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting

    A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImpl of the file ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java of th…

    y_project RuoYi
  • Low 3.5
    CVE-2024-6511

    y_project RuoYi Content-Type isJsonRequest cross site scripting

    A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross si…

    y_project RuoYi
  • Medium 4.3
    CVE-2023-7133

    y_project RuoYi HTTP POST Request login cross site scripting

    A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f…

    y_project RuoYi
  • Low 3.5
    CVE-2023-3815

    y_project RuoYi File Upload uploadFilesPath cross site scripting

    A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site sc…

    y_project RuoYi com.ruoyi:ruoyi Maven
  • Low 3.5
    CVE-2023-3163 Public exploit

    y_project RuoYi filterKeyword resource consumption

    A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulner…

    y_project RuoYi com.ruoyi:ruoyi Maven
  • Medium 5.5
    CVE-2022-4566

    y_project RuoYi GenController sql injection

    A vulnerability, which was classified as critical, has been found in y_project RuoYi 4.7.5. This issue affects some unknown processing of the file com/ruoyi/generator/controller/GenController. The manipulation leads to sql injection. The name of the patch is …

    y_project RuoYi
  • Low 3.5
    CVE-2022-4348

    y_project RuoYi-Cloud JSON cross site scripting

    A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSON Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The …

    y_project RuoYi-Cloud com.ruoyi:ruoyi-common Maven