CVE-2025-4819

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-266CWE-285

Affected software

No affected versions have been published.

Timeline

Published
May 17, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-48205.3Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rateCVE-2025-4820010.0The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.CVE-2025-482018.6The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.CVE-2025-482025.3The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482036.4The cs_seo extension through 9.2.0 for TYPO3 allows XSS.CVE-2025-482046.8The ns_backup extension through 13.0.0 for TYPO3 allows command injection.CVE-2025-482058.6The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482066.1The ns_backup extension through 13.0.0 for TYPO3 allows XSS.CVE-2025-482078.6The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.CVE-2025-482088.8Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attCVE-2025-48217.5Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rateCVE-2025-482193.5O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call