Iocoder maintains a compact portfolio of open-source enterprise application frameworks, notably RuoYi-Vue-Pro and Yudao-Cloud, that serve as development foundations for backend services and administrative platforms. Vulnerabilities affecting these products skew toward serious severity outcomes and recur through access-control and input-handling weakness classes—improper authorization, privilege assignment errors, path traversal, and template-injection flaws—that are characteristic of rapidly evolving framework codebases where permission and parsing logic can lag behind feature expansion. Defenders should monitor this vendor's releases closely given the frameworks' role in deployed business applications; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Iocoder over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-37158CRITICAL RuoYi v3.8.3 has a Weak password vulnerability in the management system. | Aug 25, 2022 | 9.8 | 30 | NO | NO |
CVE-2025-10988HIGH A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Such manipulation leads to improper authoriza | Sep 26, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-10987HIGH A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Req | Sep 26, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-10278HIGH A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId | Sep 12, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-10277HIGH A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID | Sep 12, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-10276HIGH A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of th | Sep 12, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-10275HIGH A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of the argument ids/newO | Sep 12, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-2708CRITICAL A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. This affects an unknown part of the file /admin-api/infra/file/upload of the comp | Mar 24, 2025 | 9.1 | 26 | NO | NO |
CVE-2025-2707CRITICAL A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/in | Mar 24, 2025 | 9.1 | 25 | NO | NO |
CVE-2025-2742HIGH A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent o | Mar 25, 2025 | 8.1 | 23 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Iocoder.
Media articles that mention a CVE ID that affects a product developed by Iocoder — matched by CVE ID, not by vendor name.