RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-03-30
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
CVSS Score
6.5
EPSS Score
0.001
Published
2022-03-30
Page 6