CVE-2026-101018
MediumCVSS 4.7Summary
A vulnerability in XunruiCMS up to 4.7.2 affects the group_all_edit function in dayrui/App/Member/Controllers/Admin/Home.php of the Group Editing component. Manipulation of the groupid argument causes SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker may manipulate SQL queries, potentially leading to unauthorized access, modification, or deletion of data.
Recommendation
Update XunruiCMS to the latest version or apply vendor patches. Restrict access to the admin panel and validate input data.
Other vulnerabilities in XunruiCMS
See all- CVE-2025-14007Low
A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1 in an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile in the Domain Name Binding Page component. The manipulation results in cross site scripting. The attack may be performed remotely and has a high complexity level.
- CVE-2025-14006Low
A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1 in some unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 in the Add Data Validation Page component. Manipulation of the data[name] argument leads to cross site scripting. The attack is possible remotely.
Original NVD description (English source)
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS