CVE-2025-10218 | lostvip-com ruoyi-go 2.1 Background Management Page SysRoleDao.go SelectListPage sortName sql injection

A vulnerability, which was classified as critical, has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Background Management Page. This manipulation of the argument sortName causes sql injection.

This vulnerability is registered as CVE-2025-10218. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.