Advisories · Technology
dromara RuoYi-Vue-Plus.
Every CVE that names dromara RuoYi-Vue-Plus among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
- dromara RuoYi-Vue-Plus
- Broken access control
- CVSS 2.3 Low
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- dromara RuoYi-Vue-Plus
- Broken access control
- CVSS 5.3 Medium
Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization
- Dromara RuoYi-Vue-Plus
- Privilege escalation
- Broken access control
- CVSS 7.1 High
RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
- dromara RuoYi-Vue-Plus
- Broken access control
- CVSS 5.3 Medium
Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization
- Dromara RuoYi-Vue-Plus
- Broken access control
- CVSS 6.9 Medium
Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
- Dromara RuoYi-Vue-Plus
- Path traversal