Live › vulnerability › CVE-2026-120348
XunRuiCMS 4.7.0 to 4.7.4 has a code injection flaw in _get_tpl_content in dayrui/Fcms/Library/Notice.php (email template rendering). VulDB says it can be triggered remotely without authentication and a proof of concept is public. The vendor did not respond to the researcher, and 4.7.4 (the vendor's latest release) is affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 06:21 UTC. All times on this page are UTC.
Self-hosted sites running XunRuiCMS 4.7.0 to 4.7.4 (VulDB's list) that expose the email template rendering path. VulDB says no login is required, but this comes from a secondary source and the PoC was not reviewed. Sites on other CMS products can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| xunruicms | vendor | >= 4.7.0, <= 4.7.4 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120348")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.