Live › vulnerability › CVE-2026-120347
XunRuiCMS up to 4.7.4 has an SQL injection flaw in the View function of dayrui/Fcms/Core/View.php in the Member Module, triggered by the catid argument. An attacker can send crafted requests over the network to read or change database contents, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 06:21 UTC. All times on this page are UTC.
Sites running XunRuiCMS up to version 4.7.4 with the Member Module, where the catid argument reaches the View function unsanitized. Sites on other CMS products or on a fixed release can skip it; the sources do not say whether the flaw is reachable without login.
No product ranges from the sources yet.
dayrui/Fcms/Core/View.php in your XunRuiCMS install and note the version against 4.7.44.7.4; the sources cite patch commit 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231, the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.
This page as .md · .json · in your agent: get_signal("CVE-2026-120347")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.