CVE-2026-97321
MediumCVSS 6.3Summary
A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the GoView Data Endpoint component, specifically in the GoViewDataServiceImpl.getDataBySQL function. Manipulation of the sql argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
The SQL injection vulnerability may allow an attacker to gain unauthorized access to the database, modify or leak data. The public exploit increases the risk of rapid exploitation.
Recommendation
Update ruoyi-vue-pro to a version newer than 2026.08 if available, or apply vendor patches. Until then, consider restricting access to the GoView Data endpoint and implementing SQL query parameterization.
Other vulnerabilities in ruoyi-vue-pro
See all- CVE-2026-97325Medium
A security flaw was discovered in ruoyi-vue-pro up to 2026.08 in the validOAuthClientFromCache function of OAuth2ClientServiceImpl.java. Manipulation of the redirect_uri argument results in open redirect. The exploit is public and the vendor did not respond.
- CVE-2026-97324High
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the updateDemoOrderPaid function of PayDemoOrderController. Manipulation of the ID argument leads to improper authorization, and the attack can be initiated remotely. The exploit is publicly available and the vendor did not respond to the disclosure.
- CVE-2026-97323Medium
A vulnerability was found in ruoyi-vue-pro up to 2026.08 in the getOriginalFilename function of MpMaterialServiceImpl.java in the File Upload component. Manipulation leads to path traversal. The exploit is public and the vendor did not respond.
- CVE-2026-97322Medium
A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the File Upload component, specifically in FileController.java. Manipulation of input leads to cross-site scripting (XSS). The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-97320Medium
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the AI Knowledge Module component, specifically in the AiKnowledgeDocumentServiceImpl.readUrl function. Manipulation of the url argument causes server-side request forgery (SSRF). The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-57950High
A broken access control vulnerability in ruoyi-vue-pro through 2026.05 (fixed in commit 5d1fd70) in ErpSaleOrderController allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations due to incorrect permission namespace enforcement. Attackers can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders.
- CVE-2026-57949Medium
A missing authorization vulnerability in the CRM module of ruoyi-vue-pro (up to version 2026.05, fixed in commit c779a47) exists in the GET /admin-api/crm/follow-up-record/get endpoint. Authenticated users can read any follow-up record by iterating sequential numeric IDs.
- CVE-2026-13528High
A path traversal vulnerability was found in ruoyi-vue-pro up to version 2026.04-jdk8-SNAPSHOT in the generateUploadPath function of FileServiceImpl.java. An attacker can remotely manipulate the file path, leading to unauthorized access to resources.
Original NVD description (English source)
A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoView Data Endpoint. Such manipulation of the argument sql leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS