CVE-2026-120349
HighCVSS 7.3Summary
XunRuiCMS (dayrui) through version 4.7.4 has a flaw in the str_replace function in /var/www/html/zzmob/index.php within the Mobile Site Directory component. Manipulation of the dirname argument results in code injection, and the attack can be launched remotely.
Risk Assessment
A publicly released exploit enables remote code injection, which could lead to compromise of the application or server.
Recommendation
Restrict access to the Mobile Site Directory component and apply fixes or mitigations; consider updating to a version newer than 4.7.4 when available.
Other vulnerabilities in XunRuiCMS
See all- CVE-2026-101018Medium
A vulnerability in XunruiCMS up to 4.7.2 affects the group_all_edit function in dayrui/App/Member/Controllers/Admin/Home.php of the Group Editing component. Manipulation of the groupid argument causes SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2025-14007Low
A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1 in an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile in the Domain Name Binding Page component. The manipulation results in cross site scripting. The attack may be performed remotely and has a high complexity level.
- CVE-2025-14006Low
A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1 in some unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 in the Add Data Validation Page component. Manipulation of the data[name] argument leads to cross site scripting. The attack is possible remotely.
Original NVD description (English source)
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS