CVE-2026-120348

Publié : 2 novembre 2026

Modifié : 2 novembre 2026

Score CVSS

7.3

HIGH

Description détaillée

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md https://vuldb.com/cve/CVE-2026-120348 https://vuldb.com/submit/1016298 https://vuldb.com/vuln/429672 https://vuldb.com/vuln/429672/cti

Dernières Vulnérabilités

CVE-2026-120349

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

VOIR DÉTAILS

CVE-2026-101186

DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.

VOIR DÉTAILS

CVE-2026-101185

OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

VOIR DÉTAILS