CVE-2026-120347mediumCWE-74CWE-89

CVE-2026-120347: fallo de gravedad media en dayrui XunRuiCMS

dayrui XunRuiCMS Member View.php View sql injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear XunRuiCMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.9epss 0.3%
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
dayrui · XunRuiCMS
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — dayrui XunRuiCMS

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-1177MEDIUMdayrui XunRuiCMS Linkage.php import_add deserializationEPSS 0.7%CVE-2025-1186MEDIUMdayrui XunRuiCMS Api.php deserializationEPSS 0.7%CVE-2025-14004MEDIUMdayrui XunRuiCMS Email Setting admind45f74adbd95.php server-side request forgeryEPSS 0.5%CVE-2025-14008MEDIUMdayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7e.php server-side request forgeryEPSS 0.4%CVE-2025-15144MEDIUMdayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scriptingEPSS 0.4%CVE-2025-14005MEDIUMdayrui XunRuiCMS Add Display Name Field admind45f74adbd95.php cross site scriptingEPSS 0.3%