Dromara is a modestly represented open-source ecosystem centered on a small portfolio of Java-based libraries and frameworks for web application development and authentication, including the widely used RuoYi-Vue-Plus project, SA-Token authorization library, and Hutool utility toolkit. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur across access-control, code-injection, path-traversal, XML external entity handling, and authorization-checking weaknesses that are characteristic of enterprise Java applications with complex privilege models and dynamic code generation. Defenders tracking Java web frameworks and authentication libraries should prioritize this vendor's advisories, particularly those affecting the RuoYi and SA-Token products; live exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dromara over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-66916CRITICAL The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter u | Jan 8, 2026 | 9.4 | 33 | NO | NO |
CVE-2023-44794CRITICAL An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. | Oct 25, 2023 | 9.8 | 30 | NO | NO |
CVE-2026-58176MEDIUM RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the control | Jun 30, 2026 | 6.5 | 29 | NO | NO |
CVE-2025-6925CRITICAL A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org | Jun 30, 2025 | 9.1 | 28 | NO | NO |
CVE-2023-43961HIGH An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. | Oct 25, 2023 | 8.8 | 25 | NO | NO |
CVE-2023-31581CRITICAL Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. | Oct 25, 2023 | 9.8 | 25 | NO | NO |
CVE-2023-3276HIGH A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of th | Jun 15, 2023 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dromara.
Media articles that mention a CVE ID that affects a product developed by Dromara — matched by CVE ID, not by vendor name.