ZeroDay Findings
Sign inSign up

Findings

CVE-2026-108802

A weakness has been identified in y_project RuoYi up to 4.8.3.

Published Oct 12, 2026 · updated Oct 14, 2026

A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendo

  2. Oct 14, 2026 · NIST NVD

    Updated

    A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendo

Sources

  • CVE.orgVulnerability recordCVE-2026-108802

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-108802

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-108802

    A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack

    nvd.nist.gov

References