https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-10218.htmlhttps://patchthecve.com/cve/CVE-2025-10218.htmlWed, 17 Jun 2026 08:27:55 +0000MEDIUM 6.3: A flaw has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Background Management Page. This manipulation of the argument sortName causes sql injection. Remote exploitation of the attack is possible. The exhttps://patchthecve.com/cve/CVE-2025-9413.htmlhttps://patchthecve.com/cve/CVE-2025-9413.htmlWed, 17 Jun 2026 10:08:55 +0000MEDIUM 6.3: A flaw has been found in lostvip-com ruoyi-go up to 2.1. This impacts the function SelectListByPage of the file modules/system/system_router.go. This manipulation of the argument orderByColumn/isAsc causes sql injection. The attack may be initiated remotely. The exploit has been published and may behttps://patchthecve.com/cve/CVE-2025-9412.htmlhttps://patchthecve.com/cve/CVE-2025-9412.htmlWed, 17 Jun 2026 10:08:55 +0000MEDIUM 6.3: A vulnerability was detected in lostvip-com ruoyi-go up to 2.1. This affects the function SelectListByPage of the file modules/system/dao/DictDataDao.go. The manipulation of the argument orderByColumn/isAsc results in sql injection. The attack can be launched remotely. The exploit is now public and https://patchthecve.com/cve/CVE-2025-9411.htmlhttps://patchthecve.com/cve/CVE-2025-9411.htmlWed, 17 Jun 2026 10:08:55 +0000MEDIUM 6.3: A security vulnerability has been detected in lostvip-com ruoyi-go up to 2.1. The impacted element is the function SelectPageList of the file modules/system/service/LoginInforService.go. The manipulation of the argument isAsc leads to sql injection. The attack can be initiated remotely. The exploit https://patchthecve.com/cve/CVE-2025-9410.htmlhttps://patchthecve.com/cve/CVE-2025-9410.htmlWed, 17 Jun 2026 10:08:54 +0000MEDIUM 6.3: A weakness has been identified in lostvip-com ruoyi-go up to 2.1. The affected element is the function SelectListByPage of the file modules/system/dao/GenTableDao.go. Executing manipulation of the argument isAsc/orderByColumn can lead to sql injection. It is possible to launch the attack remotely. Thttps://patchthecve.com/cve/CVE-2025-9409.htmlhttps://patchthecve.com/cve/CVE-2025-9409.htmlWed, 17 Jun 2026 10:08:54 +0000MEDIUM 4.3: A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controller/CommonController.go. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remo