A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4.
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Dayrui
- Product
- XunRuiCMS
- CVSS v3.1
- 7.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-74, CWE-89
- NVD status
- Received
Why it ranks 25 (Notable)
- CVSS v3.1 7.3 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-120347 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.