CVE-2025-7903: medium-severity vulnerability in yangzongzhuan RuoYi
yangzongzhuan RuoYi Image Source ui layer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
yangzongzhuan · RuoYiRelated CVEs — yangzongzhuan RuoYi
In the same product, most dangerous first.
CVE-2025-7901MEDIUMyangzongzhuan RuoYi Swagger UI index.html cross site scriptingEPSS 0.9%CVE-2025-7907MEDIUMyangzongzhuan RuoYi Druid application-druid.yml default credentialsEPSS 0.5%CVE-2025-10473MEDIUMyangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injectionEPSS 0.4%CVE-2025-10989MEDIUMyangzongzhuan RuoYi selectAll improper authorizationEPSS 0.4%CVE-2025-10384MEDIUMyangzongzhuan RuoYi Role cancelAll improper authorizationEPSS 0.4%CVE-2025-8847MEDIUMyangzongzhuan RuoYi edit cross site scriptingEPSS 0.4%