{"id":"CVE-2026-120347","kind":"vulnerability","aliases":["CVE-2026-120347"],"related":[],"title":"XunRuiCMS: member module catid parameter allows SQL injection remotely","description":"A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.","summary":"XunRuiCMS up to 4.7.4 has an SQL injection flaw in the View function of dayrui/Fcms/Core/View.php in the Member Module, triggered by the catid argument. An attacker can send crafted requests over the network to read or change database contents, and a public exploit has been disclosed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","php","self-hosted","xunruicms"],"not_affected_if":["member-module-disabled","not-xunruicms","patched-version"],"how_to_check":"- Look for the file `dayrui/Fcms/Core/View.php` in your XunRuiCMS install and note the version against `4.7.4`\n- Confirm whether the Member Module is enabled on the site\n- Check the installed version of XunRuiCMS against the upgrade in the sources (unknown)","fix":"- Upgrade XunRuiCMS beyond `4.7.4`; the sources cite patch commit `9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231`, the exact fixed version is unknown","status":"open","published_at":"2026-11-02T06:17:43+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","triaged_at":"2026-11-02T06:23:56+00:00","updated_at":"2026-11-02T06:23:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T06:23:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade XunRuiCMS beyond `4.7.4`; the sources cite patch commit `9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231`, the exact fixed version is unknown","reach":"internet","title":"XunRuiCMS: member module catid parameter allows SQL injection remotely","impact":"high","summary":"XunRuiCMS up to 4.7.4 has an SQL injection flaw in the View function of dayrui/Fcms/Core/View.php in the Member Module, triggered by the catid argument. An attacker can send crafted requests over the network to read or change database contents, and a public exploit has been disclosed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["xunruicms","php","self-hosted","cms"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or alters the CMS database contents","analyst_note":"Confirm the fixed release version and whether the Member Module path needs login, using the NVD entry and the upstream patch commit.","how_to_check":"- Look for the file `dayrui/Fcms/Core/View.php` in your XunRuiCMS install and note the version against `4.7.4`\n- Confirm whether the Member Module is enabled on the site\n- Check the installed version of XunRuiCMS against the upgrade in the sources (unknown)","plain_action":"","needs_analyst":true,"not_affected_if":["not-xunruicms","patched-version","member-module-disabled"],"who_is_affected":"Sites running XunRuiCMS up to version 4.7.4 with the Member Module, where the catid argument reaches the View function unsanitized. Sites on other CMS products or on a fixed release can skip it; the sources do not say whether the flaw is reachable without login.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4189,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120347':12A,15A '-2026':11A,14A '4.7.4':26B,78C '9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231':127C 'affect':79C,129C 'allow':6A 'argument':46B,98C 'attack':48B,111C 'call':126C 'catid':4A,45B,99C 'chang':59B 'cms':16B 'compon':90C,130C 'content':61B 'craft':51B 'cve':10A,13A 'databas':60B 'dayrui':74C 'dayrui/fcms/core/view.php':37B,87C 'determin':72C 'disclos':68B,118C 'execut':93C 'exploit':65B,114C 'file':86C 'flaw':31B 'function':35B,82C 'host':21B 'inject':8A,30B,104C 'launch':109C 'lead':101C 'manipul':95C 'may':120C 'member':2A,40B,91C 'modul':3A,41B,92C 'network':55B 'packag':17B 'paramet':5A 'patch':124C 'php':18B 'possibl':107C 'public':64B,117C 'read':57B 'remot':9A,112C 'request':52B 'self':20B 'self-host':19B 'send':50B 'sql':7A,29B,103C 'trigger':42B 'upgrad':133C 'util':122C 'view':34B,83C 'vulner':70C 'xunruicm':1A,22B,23B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running XunRuiCMS up to version 4.7.4 with the Member Module, where the catid argument reaches the View function unsanitized. Sites on other CMS products or on a fixed release can skip it; the sources do not say whether the flaw is reachable without login.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","high","package","php","selfhosted","xunruicms"],"first_public_at":"2026-11-02T06:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120347","severity":null,"published_at":"2026-11-02T06:17:43+00:00","modified_at":"2026-11-02T06:17:43+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","fetched_at":"2026-11-02T06:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}