CVE-2026-120347
HighCVSS 7.3Summary
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4, affecting the View function in dayrui/Fcms/Core/View.php within the Member Module component. Manipulating the catid argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the patch is identified as 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion in the database. The public availability of the exploit increases the risk of exploitation.
Recommendation
Upgrade the affected component to the version containing patch 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231 and review database query security.
Other vulnerabilities in dayrui XunRuiCMS
See all- CVE-2026-120348High
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4, affecting the _get_tpl_content function in dayrui/Fcms/Library/Notice.php within the Email Template Rendering component. The manipulation leads to code injection, and the attack can be initiated remotely. The exploit is publicly available and might be used; the vendor did not respond to the disclosure.
- CVE-2025-15144Medium
A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS