CVE-2026-4564

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in yangzongzhuan RuoYi up to 4.8.2. This issue affects some unknown processing of the file /monitor/job/ of the component Quartz Job Handler. Such manipulation of the argument invokeTarget leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-456407.0Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.CVE-2026-456417.8Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally.CVE-2026-456423.9Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perfCVE-2026-456437.8Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-456448.0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorizedCVE-2026-456457.8Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-456467.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-456477.0Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locCVE-2026-456488.8Stack-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.CVE-2026-456497.1Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally.CVE-2026-45658.8A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. PerfoCVE-2026-456504.3User interface (ui) misrepresentation of critical information in Microsoft Bing allows an unauthorized attacker to perform spoofing over a n
CVE-2026-4564: Medium severity, CVSS 4.7 | Vulnix