Live › vulnerability › CVE-2026-120349
In XunRuiCMS up to 4.7.4, the dirname argument of the Mobile Site Directory component's str_replace call in zzmob/index.php is not handled safely. A remote attacker can inject code that the server runs, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 07:21 UTC. All times on this page are UTC.
Self-hosted sites running XunRuiCMS up to 4.7.4 (VulDB lists 4.7.0 to 4.7.4) that have the Mobile Site Directory file zzmob/index.php. VulDB says no authentication is needed and the attack is remote; a public proof of concept exists. Sites without that file, or on managed hosting where it is not deployed, can skip it. Whether the component is on by default is not stated in any source.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| XunRuiCMS | vendor | <= 4.7.4 | – |
4.7.4 and older are listed as affected, and 4.7.4 is the latest release on the vendor's siteNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120349")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.