PatchTheCVE: ruvaroahttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-25533: Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlowhttps://patchthecve.com/cve/CVE-2024-25533.htmlhttps://patchthecve.com/cve/CVE-2024-25533.htmlWed, 17 Jun 2026 07:16:09 +0000CRITICAL 9.4: Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements.CVE-2024-25532: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /https://patchthecve.com/cve/CVE-2024-25532.htmlhttps://patchthecve.com/cve/CVE-2024-25532.htmlWed, 17 Jun 2026 07:16:09 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx.CVE-2024-25528: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /Perhttps://patchthecve.com/cve/CVE-2024-25528.htmlhttps://patchthecve.com/cve/CVE-2024-25528.htmlWed, 17 Jun 2026 07:16:08 +0000MEDIUM 5.9: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.CVE-2024-25531: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at https://patchthecve.com/cve/CVE-2024-25531.htmlhttps://patchthecve.com/cve/CVE-2024-25531.htmlWed, 17 Jun 2026 07:16:09 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx.CVE-2024-25530: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at https://patchthecve.com/cve/CVE-2024-25530.htmlhttps://patchthecve.com/cve/CVE-2024-25530.htmlWed, 17 Jun 2026 07:16:09 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx.CVE-2024-25529: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /Worhttps://patchthecve.com/cve/CVE-2024-25529.htmlhttps://patchthecve.com/cve/CVE-2024-25529.htmlWed, 17 Jun 2026 07:16:09 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx.CVE-2024-25527: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /Perhttps://patchthecve.com/cve/CVE-2024-25527.htmlhttps://patchthecve.com/cve/CVE-2024-25527.htmlWed, 17 Jun 2026 07:16:08 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.CVE-2024-25526: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameterhttps://patchthecve.com/cve/CVE-2024-25526.htmlhttps://patchthecve.com/cve/CVE-2024-25526.htmlWed, 17 Jun 2026 07:16:08 +0000HIGH 8.1: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx.CVE-2024-25525: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter ahttps://patchthecve.com/cve/CVE-2024-25525.htmlhttps://patchthecve.com/cve/CVE-2024-25525.htmlWed, 17 Jun 2026 07:16:08 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx.CVE-2024-25524: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id https://patchthecve.com/cve/CVE-2024-25524.htmlhttps://patchthecve.com/cve/CVE-2024-25524.htmlWed, 17 Jun 2026 07:16:08 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx.CVE-2024-25523: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter athttps://patchthecve.com/cve/CVE-2024-25523.htmlhttps://patchthecve.com/cve/CVE-2024-25523.htmlWed, 17 Jun 2026 07:16:08 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx.CVE-2024-25522: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id pahttps://patchthecve.com/cve/CVE-2024-25522.htmlhttps://patchthecve.com/cve/CVE-2024-25522.htmlWed, 17 Jun 2026 07:16:07 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx.CVE-2024-25521: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parametehttps://patchthecve.com/cve/CVE-2024-25521.htmlhttps://patchthecve.com/cve/CVE-2024-25521.htmlWed, 17 Jun 2026 07:16:07 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.CVE-2024-25520: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /Syshttps://patchthecve.com/cve/CVE-2024-25520.htmlhttps://patchthecve.com/cve/CVE-2024-25520.htmlWed, 17 Jun 2026 07:16:07 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx.CVE-2024-25519: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at https://patchthecve.com/cve/CVE-2024-25519.htmlhttps://patchthecve.com/cve/CVE-2024-25519.htmlWed, 17 Jun 2026 07:16:07 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx.CVE-2024-25518: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parametehttps://patchthecve.com/cve/CVE-2024-25518.htmlhttps://patchthecve.com/cve/CVE-2024-25518.htmlWed, 17 Jun 2026 07:16:07 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx.CVE-2024-25517: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at https://patchthecve.com/cve/CVE-2024-25517.htmlhttps://patchthecve.com/cve/CVE-2024-25517.htmlWed, 17 Jun 2026 07:16:07 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.CVE-2024-25515: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id https://patchthecve.com/cve/CVE-2024-25515.htmlhttps://patchthecve.com/cve/CVE-2024-25515.htmlWed, 17 Jun 2026 07:16:06 +0000HIGH 7.3: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.aspx.CVE-2024-25514: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parametehttps://patchthecve.com/cve/CVE-2024-25514.htmlhttps://patchthecve.com/cve/CVE-2024-25514.htmlWed, 17 Jun 2026 07:16:06 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx.CVE-2024-25513: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter athttps://patchthecve.com/cve/CVE-2024-25513.htmlhttps://patchthecve.com/cve/CVE-2024-25513.htmlWed, 17 Jun 2026 07:16:06 +0000HIGH 7.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx.CVE-2024-25511: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /Addhttps://patchthecve.com/cve/CVE-2024-25511.htmlhttps://patchthecve.com/cve/CVE-2024-25511.htmlWed, 17 Jun 2026 07:16:06 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx.CVE-2024-25510: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /Addhttps://patchthecve.com/cve/CVE-2024-25510.htmlhttps://patchthecve.com/cve/CVE-2024-25510.htmlWed, 17 Jun 2026 07:16:06 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx.CVE-2024-25509: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id https://patchthecve.com/cve/CVE-2024-25509.htmlhttps://patchthecve.com/cve/CVE-2024-25509.htmlWed, 17 Jun 2026 07:16:05 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx.CVE-2024-25512: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter https://patchthecve.com/cve/CVE-2024-25512.htmlhttps://patchthecve.com/cve/CVE-2024-25512.htmlWed, 17 Jun 2026 07:16:06 +0000HIGH 8.1: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx.CVE-2024-25508: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulhttps://patchthecve.com/cve/CVE-2024-25508.htmlhttps://patchthecve.com/cve/CVE-2024-25508.htmlWed, 17 Jun 2026 07:16:05 +0000CRITICAL 9.8: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx.CVE-2024-25507: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parahttps://patchthecve.com/cve/CVE-2024-25507.htmlhttps://patchthecve.com/cve/CVE-2024-25507.htmlWed, 17 Jun 2026 07:16:05 +0000CRITICAL 9.4: RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx.