CVE-2025-7902

A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

• CWE-79
• CWE-94

• https://github.com/yangzongzhuan/RuoYi/issues/294Exploit
• https://github.com/yangzongzhuan/RuoYi/issues/294#issue-3211205807Exploit
• https://vuldb.com/?ctiid.317016Permissions Required, VDB Entry
• https://vuldb.com/?id.317016Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.618354Third Party Advisory, VDB Entry
• https://github.com/yangzongzhuan/RuoYi/issues/294Exploit

Published

Jul 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7896A vulnerability has been found in harry0703 MoneyPrinterTurb…7.5
• CVE-2025-7897A vulnerability was found in harry0703 MoneyPrinterTurbo up …9.8
• CVE-2025-7898A vulnerability was found in Codecanyon iDentSoft 2.0. It ha…7.2
• CVE-2025-7899The powermail extension for TYPO3 allows Insecure Direct Obj…6
• CVE-2025-7900The femanager extension for TYPO3 allows Insecure Direct Obj…6.5
• CVE-2025-7901A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1…6.1
• CVE-2025-7903A vulnerability classified as problematic was found in yangz…5.4
• CVE-2025-7904A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-7905A vulnerability has been found in itsourcecode Insurance Man…8.8
• CVE-2025-7906A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1…5.4
• CVE-2025-7907A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1…4.3
• CVE-2025-7908A vulnerability was found in D-Link DI-8100 1.0. It has been…8.8