CVE-2026-38812
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
Risk Assessment
An attacker with administrative privileges may gain access to sensitive database information, posing a serious security risk to the organization.
Recommendation
It is recommended to update to the latest version of RuoYi and implement additional security measures to restrict access to the /tool/gen/createTable endpoint.
Other vulnerabilities in RuoYi v4.8.2
See all- CVE-2025-70986High
Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.
- CVE-2025-70985Critical
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside their scope.
- CVE-2026-37216Medium
Ruoyi version 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.
Original NVD description (English source)
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS