RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/yangzongzhuan/RuoYi/issues/308 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
17 Jun 2026, 09:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/yangzongzhuan/RuoYi/issues/308 - Exploit, Issue Tracking, Third Party Advisory |
19 Dec 2025, 15:44
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ruoyi
Ruoyi ruoyi |
|
| CPE | cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:* | |
| References | () https://github.com/yangzongzhuan/RuoYi/issues/308 - Exploit, Third Party Advisory, Issue Tracking |
12 Dec 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
| CWE | CWE-79 |
12 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-12 17:15
Updated : 2026-06-17 09:57
NVD link : CVE-2025-67342
Mitre link : CVE-2025-67342
CVE.ORG link : CVE-2025-67342
JSON object : View
Products Affected
ruoyi
- ruoyi
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')