---
id: "CVE-2026-120347"
kind: "vulnerability"
aliases: ["CVE-2026-120347"]
title: "XunRuiCMS: member module catid parameter allows SQL injection remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "php", "self-hosted", "xunruicms"]
not_affected_if: ["member-module-disabled", "not-xunruicms", "patched-version"]
published_at: "2026-11-02T06:17:43+00:00"
first_seen_at: "2026-11-02T06:21:54+00:00"
updated_at: "2026-11-02T06:23:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120347", "first_seen_at": "2026-11-02T06:21:54+00:00"}]
---

# XunRuiCMS: member module catid parameter allows SQL injection remotely

XunRuiCMS up to 4.7.4 has an SQL injection flaw in the View function of dayrui/Fcms/Core/View.php in the Member Module, triggered by the catid argument. An attacker can send crafted requests over the network to read or change database contents, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the file `dayrui/Fcms/Core/View.php` in your XunRuiCMS install and note the version against `4.7.4`
- Confirm whether the Member Module is enabled on the site
- Check the installed version of XunRuiCMS against the upgrade in the sources (unknown)

## Fix

- Upgrade XunRuiCMS beyond `4.7.4`; the sources cite patch commit `9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231`, the exact fixed version is unknown

## Timeline

- 2026-11-02T06:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120347

## From the sources

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_