Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 2.9 | CVE-2026-116007 |
A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09
YunaiV, zhijiantianya, YunaiV / zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro, YunaiV / zhijiantianya ruoyi-vue-pro
|
NVD | |||
|
CVE-2026-116007A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09
Executive summaryThe advisory reports that the YunaiV ruoyi-vue-pro (Yudao) project, up to version 2026.09, lets an unauthenticated attacker guess SMS verification codes without any attempt limit, which can lead to takeover of an account such as the built-in administrator. The advisory rates it Critical with a CVSS 3.1 score of 9.8, as stated by the reporter. The advisory states no fixed version exists as of 2026-09-21, and its remediation advice is to add failed-attempt counting and lockout to code verification. Technical summaryThe weakness is improper restriction of excessive authentication attempts (CWE-307, CWE-799, CWE-287) in the SMS verification code check, which keeps no failed-attempt counter, lockout, or rate limit. The attack needs only network access to the backend API and the target's mobile number, with no authentication and no user interaction; the advisory states the built-in admin's mobile number is published in the seed SQL. The advisory reports that POST /admin-api/system/auth/sms-login and POST /admin-api/system/auth/reset-password both accept a correct code, and that the login scene (scene=21) needs no CAPTCHA. Affected branches are listed as master, master-jdk17, and master-jdk25, with verified version master-jdk17 @ 7cab3a7; the fixed version is stated as none as of 2026-09-21. A workaround is not stated beyond the remediation suggestions, and no detection guidance is given beyond the advisory's suggestion to alert on abnormal verification volume per mobile and IP. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/63e3a697e…ffd41c1cbfdbb1fcd5b4 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsYunaiVzhijiantianyaYunaiV / zhijiantianyaYunaiV ruoyi-vue-prozhijiantianya ruoyi-vue-proYunaiV / zhijiantianya ruoyi-vue-pro
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||