# CVE-2025-7901: RuoYi - XSS

> Live exploitation tracking for CVE-2025-7901 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-7901

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** yangzongzhuan RuoYi
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')); CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** web_application

## Description

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be initiated remotely.

## CrowdSec analysis

[CVE-2025-7901](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-7901) is a cross-site scripting vulnerability in yangzongzhuan RuoYi up to version 4.8.1, specifically affecting the Swagger UI component via the configUrl parameter. This flaw allows remote attackers to inject malicious scripts, potentially leading to session hijacking or unauthorized actions when users interact with the affected interface.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-7901 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/swagger-ui/index.html` endpoint by injecting malicious URLs into the `configUrl` parameter, leading to DOM-based XSS and execution of arbitrary scripts in users' browsers.

## Timeline

- 2025-07-20: CVE Published. CVE-2025-7901 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2025-7901 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/yangzongzhuan/RuoYi/issues/293
- https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-7901.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-7901) follows observed exploitation activity for CVE-2025-7901. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.