CVE-2025-67342

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.

• CWE-79

• https://github.com/yangzongzhuan/RuoYi/issues/308Exploit, Issue Tracking, Third Party Advisory

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67316An issue in realme Internet browser v.45.13.4.1 allows a rem…5.4
• CVE-2025-6732A vulnerability was found in UTT HiPER 840G up to 3.1.1-1903…8.8
• CVE-2025-67325Unrestricted file upload in the hotel review feature in QloA…9.8
• CVE-2025-6733A vulnerability was found in UTT HiPER 840G up to 3.1.1-1903…8.8
• CVE-2025-6734A vulnerability was found in UTT HiPER 840G up to 3.1.1-1903…8.8
• CVE-2025-67341jshERP versions 3.5 and earlier are affected by a stored XSS…4.6
• CVE-2025-67344jshERP v3.5 and earlier is affected by a stored Cross Site S…4.6
• CVE-2025-67349A cross-site scripting (XSS) vulnerability was identified in…6.1
• CVE-2025-6735A vulnerability classified as critical has been found in juz…8.8
• CVE-2025-6736A vulnerability classified as critical was found in juzaweb …8.8
• CVE-2025-67364fast-filesystem-mcp version 3.4.0 contains a critical path t…7.5
• CVE-2025-67366@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provi…7.5