CVE-2026-101018— dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
Quick assessment
Affected
dayrui XunruiCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 dayrui XunruiCMS（最高至 4.7.2 版本）中发现了一个漏洞。该问题影响的是 Group Editing 组件中文件 的 函数。通过对 参数的操纵，可导致 SQL 注入。此攻击可远程实施。该漏洞利用代码已公开披露，且可能被利用。厂商在漏洞披露前早期已被联系，但未作出任何回应。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-101018
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-101018
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-101018
请登录查看更多情报信息。
Other References for CVE-2026-101018 (3)
-
https://vuldb.com/cve/CVE-2026-101018 third-party-advisory
-
https://vuldb.com/submit/922935 third-party-advisory
IV. Related Vulnerabilities
Same product: XunruiCMS
-
CVE-2025-15144
dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross s -
CVE-2025-14008
dayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7 -
CVE-2025-14007
dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php c -
CVE-2025-14006
dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php c -
CVE-2025-14005
dayrui XunRuiCMS Add Display Name Field admind45f74adbd95.ph
Same vendor: dayrui
-
CVE-2025-15144
dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross s -
CVE-2025-14008
dayrui XunRuiCMS Project Domain Change Test admin79f2ec220c7 -
CVE-2025-14007
dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php c -
CVE-2025-14006
dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php c -
CVE-2025-14005
dayrui XunRuiCMS Add Display Name Field admind45f74adbd95.ph
Same weakness: CWE-89
-
CVE-2026-86595
SQLi in Iron Mountain's enVision -
CVE-2026-73640
Time-based SQL Injection in Dayforce Payroll -
CVE-2026-101013
mathurvishal CloudClassroom-PHP-Project updateresultdetails. -
CVE-2026-101012
mathurvishal CloudClassroom-PHP-Project makeresult.php sql i -
CVE-2026-101011
aaPanel BaoTa Domain domainMod.py get_domain_status sql inje
V. Comments for CVE-2026-101018
No comments yet