PT-2025-50954
CVE-2025-67342
·
Published
2025-12-12
·
Updated
2026-10-14
Description by
CVSS 3.1
4.6
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
RuoYi versions 4.8.1 and earlier
Description
The software contains a stored cross-site scripting (XSS) issue in the
/system/menu/edit API endpoint. The existing XSS filter can be bypassed, allowing for exploitation. Because the menu is shared across all users, a user with menu modification permissions can impact all users. The vulnerable parameter is not specified.Recommendations
Update to a version later than 4.8.1.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾