PT-2026-98249 · Yunaiv · Ruoyi-Vue-Pro
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09
Description
A remote SQL injection issue exists in the GoView Data Endpoint. The flaw is located in the
getDataBySQL() function within the GoViewDataServiceImpl.java file. An attacker can manipulate the sql argument to execute arbitrary SQL commands.Recommendations
Update to a version newer than 2026.08.
As a temporary workaround, restrict access to the
getDataBySQL() function to minimize the risk of exploitation.Exploit
Fix
SQL injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ruoyi-Vue-Pro