{"id":"CVE-2025-67342","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-67342","generatedAt":"2026-10-28T00:18:31.575Z","title":"RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint.","description":"RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.","published":"2025-12-12T17:15:45.000Z","lastModified":"2026-10-14T20:10:00.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":4.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["ruoyi/ruoyi"],"epss":{"score":0.00177,"percentile":0.07249,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/yangzongzhuan/RuoYi/issues/308","tags":["Exploit","Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-67342","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}