CVE-2025-28412

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-284139.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController componentCVE-2025-28424.3A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo OpeCVE-2025-28438.8A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-SCVE-2025-28469.8A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects the function registraCVE-2025-28478.8A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown proCVE-2025-28486.3A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some nonCVE-2025-28495.5A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of tCVE-2025-28503.5A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX18CVE-2025-28518.0A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, CVE-2025-28524.7A vulnerability has been found in SourceCodester Food Ordering Management System up to 1.0 and classified as critical. Affected by this vulnCVE-2025-28536.5An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of CVE-2025-28548.8A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknow
CVE-2025-28412: Critical severity, CVSS 9.8 | Vulnix