CVE-2025-14856

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-94

Affected software

Vendor	Product	Versions
y_project	RuoYi	4.8.0; 4.8.1

References

https://github.com/ltranquility/CVE/issues/26Exploit, Third Party Advisory
https://vuldb.com/?ctiid.337047Permissions Required, VDB Entry
https://vuldb.com/?id.337047Third Party Advisory, VDB Entry
https://vuldb.com/?submit.710152Third Party Advisory, VDB Entry
https://vuldb.com/?submit.736164

Timeline

Published: Dec 18, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-148575.4An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory wri CVE-2025-148585.1The Semtech LR11xx LoRa transceivers running early versions of firmware contains an information disclosure vulnerability in its firmware val CVE-2025-148597.0The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the imp CVE-2025-14867.1The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect CVE-2025-148609.8Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1.CVE-2025-148618.8Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2025-148644.3The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in CVE-2025-148656.4The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'conten CVE-2025-148668.8The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is du CVE-2025-148676.5The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of t CVE-2025-148688.8The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in CVE-2025-148697.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.