CVE-2025-28401

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-284029.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameterCVE-2025-284037.2An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the reqCVE-2025-284059.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus methodCVE-2025-284069.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameterCVE-2025-284078.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properCVE-2025-284089.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpCVE-2025-284098.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properCVE-2025-28415.3The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through thCVE-2025-284109.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whetheCVE-2025-284119.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSaveCVE-2025-284129.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeControllerCVE-2025-284139.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
CVE-2025-28401: Medium severity, CVSS 6.7 | Vulnix