CVE-2025-14007lowCWE-79CWE-94

CVE-2025-14007: fallo de gravedad baja en dayrui XunRuiCMS

dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear XunRuiCMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2epss 0.3%
A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the component Domain Name Binding Page. The manipulation results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
dayrui · XunRuiCMS
CVEs relacionadas — dayrui XunRuiCMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-1177MEDIUMdayrui XunRuiCMS Linkage.php import_add deserializationEPSS 0.7%CVE-2025-1186MEDIUMdayrui XunRuiCMS Api.php deserializationEPSS 0.7%CVE-2025-14004MEDIUMdayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgeryEPSS 0.5%CVE-2025-14008MEDIUMdayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7e.php server-side request forgeryEPSS 0.4%CVE-2025-15144MEDIUMdayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scriptingEPSS 0.4%CVE-2026-120347MEDIUMdayrui XunRuiCMS Member View.php View sql injectionEPSS 0.3%