{"id":"CVE-2026-120348","kind":"vulnerability","aliases":["CVE-2026-120348"],"related":[],"title":"XunRuiCMS: email template rendering lets remote attackers inject code","description":"A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"XunRuiCMS 4.7.0 to 4.7.4 has a code injection flaw in _get_tpl_content in dayrui/Fcms/Library/Notice.php (email template rendering). VulDB says it can be triggered remotely without authentication and a proof of concept is public. The vendor did not respond to the researcher, and 4.7.4 (the vendor's latest release) is affected.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"xunruicms","fixed":[],"affected":">= 4.7.0, <= 4.7.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["other","php","self-hosted","xunruicms"],"not_affected_if":["not-xunruicms","version-above-4.7.4"],"how_to_check":"- Find the XunRuiCMS version in the admin panel or in the project's version file. 4.7.0 to 4.7.4 are listed as affected by VulDB.\n- Check whether dayrui/Fcms/Library/Notice.php exists and contains _get_tpl_content.\n- Check web server logs for unusual requests that reach email or notice template functions.\n- Also check older 4.x releases: VulDB lists only 4.7.0 to 4.7.4, but the submission was tested on 4.7.2.","fix":null,"status":"open","published_at":"2026-11-02T06:17:43+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","triaged_at":"2026-11-02T06:23:55+00:00","updated_at":"2026-11-02T06:25:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T06:23:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"XunRuiCMS: email template rendering lets remote attackers inject code","impact":"high","summary":"XunRuiCMS up to version 4.7.4 has a code injection flaw in the email template rendering function of Fcms/Library/Notice.php. A remote attacker can inject code that the server then runs, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["xunruicms","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs injected code on the web server","analyst_note":"Confirm whether authentication or a specific template feature is required, and whether the vendor or a patch exists, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-120348.","how_to_check":"- Check the installed XunRuiCMS version against `4.7.4` and confirm whether the file dayrui/Fcms/Library/Notice.php is present\n- Review whether the email template feature is reachable from the internet","plain_action":"","needs_analyst":true,"not_affected_if":["not-xunruicms","version-above-4.7.4"],"who_is_affected":"Sites running XunRuiCMS up to 4.7.4 are exposed through the email template rendering code path in Notice.php. The sources do not say whether the flaw needs an admin login or a non-default setting, so treat any reachable installation as exposed until checked. Sites on other CMS products are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4164,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether authentication or a specific template feature is required, and whether the vendor or a patch exists, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-120348.","search":"'-120348':12A,15A '-2026':11A,14A '4.7.0':24B '4.7.4':26B,66B,83C 'affect':73B,84C 'attack':7A,111C 'authent':49B 'avail':120C 'code':9A,29B,108C 'compon':100C 'concept':54B 'contact':128C 'content':35B,93C 'cve':10A,13A 'dayrui':79C 'dayrui/fcms/library/notice.php':37B,97C 'disclosur':132C 'earli':129C 'email':2A,38B,101C 'exploit':117C 'file':96C 'flaw':31B 'function':90C 'get':33B,91C 'host':21B 'identifi':77C 'initi':114C 'inject':8A,30B,109C 'latest':70B 'lead':106C 'let':5A 'manipul':105C 'might':122C 'php':18B 'proof':52B 'public':56B,119C 'releas':71B 'remot':6A,47B,115C 'render':4A,40B,103C 'research':64B 'respond':61B,136C 'say':42B 'self':20B 'self-host':19B 'templat':3A,39B,102C 'tpl':34B,92C 'trigger':46B 'use':124C 'vendor':58B,68B,126C 'vuldb':41B 'vulner':75C,87C 'way':139C 'without':48B 'xunruicm':1A,22B,23B,80C 'xunruicms':16A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted sites running XunRuiCMS 4.7.0 to 4.7.4 (VulDB's list) that expose the email template rendering path. VulDB says no login is required, but this comes from a secondary source and the PoC was not reviewed. Sites on other CMS products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["xunruicms"],"ptokens":["xunruicms"],"labels":["high","other","php","selfhosted","xunruicms"],"first_public_at":"2026-11-02T06:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120348","severity":null,"published_at":"2026-11-02T06:17:43+00:00","modified_at":"2026-11-02T06:17:43+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","fetched_at":"2026-11-02T06:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120348:1354","url":null,"severity":null,"published_at":"2026-11-02T06:25:39+00:00","modified_at":"2026-11-02T06:25:39+00:00","first_seen_at":"2026-11-02T06:25:39+00:00","fetched_at":"2026-11-02T06:25:39+00:00","note":"VulDB (secondary; links a GitHub advisory/PoC I could not open) says remote, no auth needed, PoC public, vendor silent. Vendor bug list (xunruicms.com/bug) does not list this CVE and names 4.7.4 as latest, which is affected, so no fixed version. No exploitation in the wild seen. Nothing verified: no vendor advisory exists."}],"documents":[{"id":50604,"url":"https://vuldb.com/vuln/429672","title":"VulDB VDB-429672: XunRuiCMS up to 4.7.4 Notice.php code injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":50605,"url":"https://www.xunruicms.com/bug/","title":"XunRuiCMS vendor known-vulnerability list (latest 4.7.4)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":50606,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120348","title":"NVD CVE-2026-120348","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}