CVE-2025-7902: falha de média gravidade em yangzongzhuan RuoYi
yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.3%
A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
yangzongzhuan · RuoYiCVEs relacionadas — yangzongzhuan RuoYi
No mesmo produto, das mais perigosas para as menos.
CVE-2025-7901MEDIUMyangzongzhuan RuoYi Swagger UI index.html cross site scriptingEPSS 0.9%CVE-2025-7907MEDIUMyangzongzhuan RuoYi Druid application-druid.yml default credentialsEPSS 0.5%CVE-2025-10473MEDIUMyangzongzhuan RuoYi Blacklist SqlUtil.java filterKeyword sql injectionEPSS 0.4%CVE-2025-10989MEDIUMyangzongzhuan RuoYi selectAll improper authorizationEPSS 0.4%CVE-2025-10384MEDIUMyangzongzhuan RuoYi Role cancelAll improper authorizationEPSS 0.4%CVE-2025-8847MEDIUMyangzongzhuan RuoYi edit cross site scriptingEPSS 0.4%