CVE-2025-67342
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
RuoYi versions 4.8.1 and earlier contain a stored XSS vulnerability in the /system/menu/edit endpoint. Although the endpoint is protected by an XSS filter, the protection can be bypassed, and because the menu is shared across all users, any user with menu modification permissions can impact all users.
Risk Assessment
An attacker with menu editing permissions can inject a malicious script that executes in the browsers of all system users. This may lead to session theft, account takeover, or further attacks.
Recommendation
Update RuoYi to a version newer than 4.8.1 if available. Restrict menu modification permissions to trusted administrators and consider additional input filtering.
Other vulnerabilities in RuoYi
See all- CVE-2025-70986High
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
- CVE-2026-38812Critical
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
- CVE-2025-70985Critical
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside their scope.
- CVE-2024-57521Critical
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
- CVE-2026-108825Medium
A vulnerability was found in RuoYi up to version 4.8.3 in the checkRoleAllowed function of the /system/role/authDataScope file. Manipulation of the roleKey argument leads to improper privilege management. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-108803Medium
A security vulnerability has been detected in y_project RuoYi up to 4.8.3. It impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. The attack can be initiated remotely. The vendor was contacted but did not respond.
- CVE-2026-108800Medium
A vulnerability in RuoYi 4.8.3 involves an unknown function that allows cross-site request forgery (CSRF). The attack can be executed remotely.
- CVE-2026-37216Medium
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
- CVE-2025-46175High
Ruoyi v4.8.0 is vulnerable to incorrect access control. The authRole method in SysUserController.java is missing a checkUserDataScope permission check. This may allow unauthorized access to user role operations.
- CVE-2025-10989Medium
A security flaw was discovered in yangzongzhuan RuoYi up to 4.8.1. The file /system/role/authUser/selectAll is affected; manipulating the userIds argument results in improper authorization. The attack can be initiated remotely and the exploit has been released. The vendor was contacted but did not respond.
Original NVD description (English source)
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS