Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ruoyi-vue-pro — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in ruoyi-vue-pro, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the ruoyi-vue-pro project, a popular open-source enterprise management framework developed under the RuoYi ecosystem, focusing on security flaws reported within the Java and Vue.js technology stack. The collection encompasses various classes of software weaknesses, including remote code execution, unauthorized access, and SQL injection, documenting incidents from the project's initial public release through the most recent security advisories. Readers can utilize this resource to monitor the security posture of the vendor, analyze the prevalence of specific weakness categories within the codebase, and review the chronological history of disclosed defects to assess long-term stability and patching frequency. By examining this aggregated data, developers and security analysts gain insight into recurring issue patterns and the effectiveness of upstream security measures over time. This compilation serves as a factual reference for evaluating the risk profile of systems built upon this framework, highlighting how previously identified gaps have been addressed or remain active in legacy versions. The data reflects community-reported findings and official maintenance responses, providing a comprehensive view of the project’s security evolution without editorial commentary.

Vendor: zhijiantianya

CVE ID Title CVSS Severity Published
CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl CWE-918 5.4 Medium 2026-10-14
CVE-2026-97325 YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect CWE-601 4.3 Medium 2026-09-24
CVE-2026-97324 YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization CWE-285 7.3 High 2026-09-24
CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal CWE-22 6.3 Medium 2026-09-24
CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting CWE-79 4.3 Medium 2026-09-24
CVE-2026-97321 YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection CWE-89 6.3 Medium 2026-09-24
CVE-2026-97320 YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery CWE-918 6.3 Medium 2026-09-24
CVE-2026-57950 ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController CWE-863 8.1 High 2026-06-29
CVE-2026-57949 ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint CWE-862 6.5 Medium 2026-06-29
CVE-2026-13528 YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal CWE-22 7.3 High 2026-06-29
CVE-2025-10988 YunaiV ruoyi-vue-pro transfer improper authorization CWE-285 6.3 Medium 2025-09-26
CVE-2025-10278 YunaiV ruoyi-vue-pro transfer improper authorization CWE-285 6.3 Medium 2025-09-12
CVE-2025-10276 YunaiV ruoyi-vue-pro transfer improper authorization CWE-285 6.3 Medium 2025-09-12
CVE-2025-2744 zhijiantianya ruoyi-vue-pro Material Upload Interface upload-news-image path traversal CWE-22 5.4 Medium 2025-03-25
CVE-2025-2743 zhijiantianya ruoyi-vue-pro Material Upload Interface upload-temporary path traversal CWE-22 4.3 Medium 2025-03-25
CVE-2025-2742 zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal CWE-22 5.4 Medium 2025-03-25
CVE-2025-2708 zhijiantianya ruoyi-vue-pro Backend File Upload Interface upload path traversal CWE-22 5.4 Medium 2025-03-24
CVE-2025-2707 zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal CWE-22 5.4 Medium 2025-03-24
CVE-2025-2040 zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine CWE-1336 6.3 Medium 2025-03-06

All 19 known CVE vulnerabilities affecting ruoyi-vue-pro with full Chinese analysis, references, and POCs where available.