（CVE-2025-7901）RuoYi Swagger UI组件configUrl参数跨站脚本漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-7901
• https://www.cve.org/CVERecord?id=CVE-2025-7901
• https://github.com/yangzongzhuan/RuoYi/issues/293
• https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-7901.yaml
• https://vuldb.com/?id.317015
• https://avd.aliyun.com/detail?id=AVD-2025-7901
• https://cert.kenet.or.ke/cve-2025-7901-ruoyi-swagger-ui-cross-site-scripting-vulnerability

Related Vulnerabilities

• PoCCVE-2022-39258: Mailcow Dockerized Swagger UI - Cross-Site Scripting
• AJ-Report积木报表 /dataSet/testTransform;swagger-ui 代码执行漏洞 （CVE-2024-7314）
• MineAdmin企业级后台管理系统swagger信息泄露漏洞
• RuoYi AI /prod-api/system/model/list 信息泄露漏洞（CVE-2025-3199）
• jshERP /jshERP-boot/webjars/swagger-ui/css/..;1=1/..;1=1/..;1=1/user/info 权限绕过漏洞（CVE-2025-60801）
• Swagger-UI-XSS: 3.14.1<=Swagger-UI-XSS< 3.38.0
• Exrick Xboot Swagger SecurityController.java服务器端请求伪造(CVE-2025-8527)
• AJ-Report /;swagger-ui/dataSource/pageList SQL 注入漏洞（CVE-2024-5350）
• PoCCVE-2018-25031: Swagger UI < 3.38.0 - Cross-Site Scripting
• PoCCVE-2025-8191: Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting