Vendor coverage
Track published CVEs, severity trends, and remediation context for dromara products.
Search results
Showing 1-6 of 6 vulnerabilities.
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing attackers to use the File class to perform arbitrary file reading and writing.
CVSS
9.4
CRITICAL
Published
Jan 8, 2026
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS
5.5
MEDIUM
Published
Jun 30, 2025
An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.
CVSS
9.8
CRITICAL
Published
Oct 25, 2023
An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVSS
8.8
HIGH
Published
Oct 25, 2023
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
CVSS
9.8
CRITICAL
Published
Oct 25, 2023
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS
5.5
MEDIUM
Published
Jun 15, 2023
