CVE-2026-120347 Details
Description
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.
A SQL injection vulnerability has been identified in Dayrui XunRuiCMS versions through 4.7.4. The issue resides in the Member Module, specifically within the View function of the file dayrui/Fcms/Core/View.php. The vulnerability allows remote attackers to manipulate the catid argument, leading to unauthorized SQL injection. This exploitation can be used to read arbitrary data from the database, including sensitive information such as backend account passwords.
Users are advised to upgrade to the patched version of XunRuiCMS. The latest version can be obtained from the XunRuiCMS repository on Gitee.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitee.com/dayrui/xunruicms/ | [email protected] | Vendor |
| https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231 | [email protected] | Source CodeVendor |
| https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-120347 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1016284 | [email protected] | Permission Required |
| https://vuldb.com/vuln/429671 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429671/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dayrui XunRuiCMS | <= 4.7.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |