CVE-2026-108800— yangzongzhuan RuoYi cross-site request forgery
Quick assessment
Affected
yangzongzhuan RuoYi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 yangzongzhuan RuoYi 4.8.3 中发现了一个漏洞。受影响的元素是一个未知函数。此类操作会导致跨站请求伪造（CSRF）。攻击可以远程执行。供应商在披露前已被联系，但没有任何回应。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| yangzongzhuan | RuoYi | 4.8.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108800
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
yangzongzhuan RuoYi cross-site request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| yangzongzhuan | RuoYi | 4.8.3 |
cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-108800
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108800
请登录查看更多情报信息。
Other References for CVE-2026-108800 (1)
-
🔗 Page not found · GitHub · GitHub broken-link
IV. Related Vulnerabilities
Same product: RuoYi
-
CVE-2026-108825
yangzongzhuan RuoYi authDataScope checkRoleAllowed privilege -
CVE-2026-108803
y_project RuoYi Disable API add changeStatus session expirat -
CVE-2026-108802
y_project RuoYi Dictionary Data Drawer Preview add renderDra -
CVE-2026-4564
yangzongzhuan RuoYi Quartz Job job code injection -
CVE-2025-14856
y_project RuoYi getnames code injection
Same vendor: yangzongzhuan
-
CVE-2026-108825
yangzongzhuan RuoYi authDataScope checkRoleAllowed privilege -
CVE-2026-76576
yangzongzhuan RuoYi-Vue Common Download Endpoint CommonContr -
CVE-2026-9374
yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUp -
CVE-2026-4564
yangzongzhuan RuoYi Quartz Job job code injection -
CVE-2025-10989
yangzongzhuan RuoYi selectAll improper authorization
Same weakness: CWE-352
-
CVE-2026-103076
WordPress User Registration plugin <= 5.2.8 - Cross Site Req -
CVE-2026-54459
FileRise: Missing CSRF enforcement for file creation and sha -
CVE-2022-51020
Flower before 2.2.0 CSRF via Worker and Task Control API End -
CVE-2026-59977
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unaut -
CVE-2026-108479
WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Re
V. Comments for CVE-2026-108800
No comments yet