CVE-2026-120347

Publié : 2 novembre 2026

Modifié : 2 novembre 2026

Score CVSS

7.3

HIGH

Description détaillée

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://gitee.com/dayrui/xunruicms/https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231 https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md https://vuldb.com/cve/CVE-2026-120347 https://vuldb.com/submit/1016284 https://vuldb.com/vuln/429671 https://vuldb.com/vuln/429671/cti

Dernières Vulnérabilités

CVE-2026-120349

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

VOIR DÉTAILS

CVE-2026-101186

DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.

VOIR DÉTAILS

CVE-2026-101185

OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

VOIR DÉTAILS