CVE-2026-120347
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4
- Risk score
- 49/100
- CVSS
- 7.3 v3.1
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly discl…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.3 high
- Remotely exploitable without logging in
References
- https://gitee.com/dayrui/xunruicms/
- https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231
- https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md
- https://vuldb.com/cve/CVE-2026-120347
- https://vuldb.com/submit/1016284
- https://vuldb.com/vuln/429671
- https://vuldb.com/vuln/429671/cti
Original description
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.
Last activity 2 Nov 2026. Patch Forecast updates every hour.