References https://tttang.com/archive/1712/ https://www.cnblogs.com/backlion/p/18896463 https://cloud.tencent.com/developer/article/2370898 https://github.com/ax1sX/SecurityList/blob/main/Java_OA/RuoYi.md https://nvd.nist.gov/vuln/detail/CVE-2023-49371 https://blog.csdn.net/weixin_30832143/article/details/95099205 https://www.cnblogs.com/pursue-security/p/17658404.html https://cn-sec.com/archives/2292367.html https://gitee.com/y_project/RuoYi/issues/I65V2B https://blog.takake.com/posts/41565/
Related VulnerabilitiesRuoYi AI /prod-api/system/model/list 信息泄露漏洞(CVE-2025-3199)(CVE-2025-7901)RuoYi Swagger UI组件configUrl参数跨站脚本漏洞PoCCNVD-2021-01931: Ruoyi Management System - Local File InclusionPoCruoyi-druid-unauth: 若依管理系统未授权访问RuoYi-Vue-Plus sendMessageWithAttachment 任意文件读取漏洞RuoYi AI /prod-api/auth/login 默认口令漏洞(CVE-2025-3202) RuoYi-ai系统未授权访问漏洞ruoyi-vue-pro 路径遍历漏洞若依-RuoYi-Vue getUsersByPhone 未授权访问漏洞