CVE-2025-10218
Last modified
CVE-2025-10218 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A flaw has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Background Management Page. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
A flaw has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Background Management Page. This manipulation of the argument sortName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lostvip | Ruoyi-Go | 2.1 |
References
- https://github.com/on-theway/cve/issues/10Broken Link
- https://vuldb.com/?ctiid.323486Permissions Required, VDB Entry
- https://vuldb.com/?id.323486Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.641027Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-10218?
How severe is CVE-2025-10218?
How do I fix CVE-2025-10218?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-10212The SiteAlert (Formerly WP Health) plugin for WordPress is v…5.3
- CVE-2025-10213DLL search path hijacking vulnerability in the UPDF.exe exec…7.8
- CVE-2025-10214DLL search path hijacking vulnerability in the UPDF.exe exec…7.8
- CVE-2025-10215DLL search path hijacking vulnerability in the UPDF.exe exec…7.8
- CVE-2025-10216A vulnerability was detected in GrandNode up to 2.3.0. The i…2.6
- CVE-2025-10217A vulnerability exists in Asset Suite for an authenticated u…6
- CVE-2025-10219Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-1022Versions of the package spatie/browsershot before 5.0.5 are …8.2
- CVE-2025-10220Use of Unmaintained Third Party Components (CWE-1104) in the…9.8
- CVE-2025-10221Insertion of Sensitive Information into Log File (CWE-532) i…6.7
- CVE-2025-10222Exposure of Sensitive Information to an Unauthorized Actor (…4.8
- CVE-2025-10223Insufficient Session Expiration (CWE-613) in the Web Admin P…8.1
Are you affected by CVE-2025-10218?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST