YunaiV

7 results · Clear filters · Feed

• High 7.3
  CVE-2026-116006 Scanner template

  YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication

  A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in impro…

  YunaiV zhijiantianya ruoyi-vue-pro ruoyi-vue-pro
  Oct 25, 2026
• High 7.1
  CVE-2026-116016

  yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

  yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests…

  YunaiV yudao-cloud
  Oct 24, 2026
• High 7.3
  CVE-2026-97324

  YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization

  A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the co…

  YunaiV zhijiantianya ruoyi-vue-pro ruoyi-vue-pro
  Sep 24, 2026
• High 7.3
  CVE-2026-13528

  YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal

  A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java o…

  YunaiV zhijiantianya ruoyi-vue-pro ruoyi-vue-pro
  Jun 29, 2026
• High 7.3
  CVE-2026-7710

  YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication

  A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument mock-token results in imp…

  YunaiV yudao-cloud
  May 3, 2026
• High 7.3
  CVE-2026-7679

  YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication

  A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulati…

  YunaiV yudao-cloud
  May 3, 2026
• High 7.3
  CVE-2026-5147 Public exploit

  YunaiV yudao-cloud get-by-website sql injection

  A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack r…

  YunaiV yudao-cloud
  Mar 30, 2026