CVE-2026-120349High· 7.3▾ MidnightPoC availableA security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument di…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
XunRuiCMS 4.7.0XunRuiCMS 4.7.1XunRuiCMS 4.7.2XunRuiCMS 4.7.3XunRuiCMS 4.7.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120348High· 7.3dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection
CVE-2026-101018Medium· 4.7A vulnerability was determined in dayrui XunruiCMS up to 4.7.2
CVE-2026-120347High· 7.3dayrui XunRuiCMS Member View.php View sql injection
CVE-2025-15144Medium· 4.3A weakness has been identified in dayrui XunRuiCMS up to 4.7.1
CVE-2025-14007Low· 2.0A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1
CVE-2025-14006Low· 3.5A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1