CVE-2026-116006High· 7.3▾ TwilightA vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
ruoyi-vue-pro 2026.09ruoyi-vue-pro 2026.09Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116007Low· 3.7YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication
CVE-2026-110610Medium· 5.4ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney …
CVE-2026-97324High· 7.3A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
CVE-2026-97325Medium· 4.3A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
CVE-2026-97322Medium· 4.3A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
CVE-2026-97323Medium· 6.3A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08