Dromara

dromara

6 CVEs • 4 products

Products (4)

Click to collapse

Toggle

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-66916 1Dromara 1Ruoyi Vue Plus Jan 30, 2026 Jan 8, 2026 N/A· v4 9.4 CRITICAL· v3 N/A· v2 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the...Show more The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.Show less
CVE-2025-6925 1Dromara 1Ruoyi Vue Plus Sep 16, 2025 Jun 30, 2025 5.5 MEDIUM· v4 9.1 CRITICAL· v3 5.0 MEDIUM· v2 A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController....Show more A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-44794 1Dromara 1Sa Token Nov 21, 2024 Oct 25, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
CVE-2023-43961 1Dromara 1Sa Token Nov 21, 2024 Oct 25, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVE-2023-31581 1Dromara 1Sureness Nov 21, 2024 Oct 25, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
CVE-2023-3276 1Dromara 1Hutool Nov 21, 2024 Jun 15, 2023 N/A· v4 7.5 HIGH· v3 5.2 MEDIUM· v2 A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The mani...Show more A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less