CVE-2025-10473

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-104755.5A weakness has been identified in SpyShelter up to 15.4.0.1015. Affected is an unknown function in the library SpyShelter.sys of the compone CVE-2025-104764.3The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_d CVE-2025-104779.8A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an un CVE-2025-104799.8A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function CVE-2025-10488.8Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to ex CVE-2025-104809.8A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /sa CVE-2025-104818.8A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of CVE-2025-104829.8A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin CVE-2025-104838.8A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionalit CVE-2025-104849.8The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all version CVE-2025-104854.3A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_l CVE-2025-104865.3The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through