| 标题 | RuoYi https://github.com/yangzongzhuan/RuoYi <=v4.8.1 Stored XSS |
|---|
| 描述 | When users add notification announcements, they can insert XSS payloads without any restrictions, which are then stored in the database. On the display page, the content is output without any encoding processing, resulting in stored XSS vulnerabilities. |
|---|
| 来源 | ⚠️ https://github.com/yangzongzhuan/RuoYi/issues/294 |
|---|
| 用户 | ZAST.AI (UID 87884) |
|---|
| 提交 | 2025-07-18 11時23分 (1 年前) |
|---|
| 管理 | 2025-07-19 16時08分 (1 day later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 317016 [yangzongzhuan RuoYi 直到 4.8.1 SysNoticeController.java addSave 跨网站脚本] |
|---|
| 积分 | 17 |
|---|