Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120347— dayrui XunRuiCMS Member View.php View sql injection

Quick assessment

Affected

dayrui XunRuiCMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

经确认，Dayrui XunRuiCMS 4.7.4 及以下版本存在漏洞。该漏洞影响成员模块（Member Module）中文件的函数。攻击者可通过操纵参数引发 SQL 注入。此攻击可远程发起，且相关利用方式已公开披露，可能被利用。修复补丁标识为。建议立即升级受影响的组件。

CVSS 7.3 · High Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

dayrui XunRuiCMS Member View.php View sql injection

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dayrui	XunRuiCMS	4.7.0	`cpe:2.3:a:xunruicms:xunruicms::::::::`

II. Public POCs for CVE-2026-120347

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120347

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-120347 (1)

CVE-2026-120347 | dayrui XunRuiCMS up to 4.7.4 Member View.php View catid sql injection vdb-entry technical-description

Other References for CVE-2026-120347 (6)

https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231 patch
https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md exploit
https://gitee.com/dayrui/xunruicms/ product
https://vuldb.com/cve/CVE-2026-120347 third-party-advisory
https://vuldb.com/vuln/429671/cti signature permissions-required
https://vuldb.com/submit/1016284 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120347

Same Patch Batch · dayrui · 2026-11-02 · 3 CVEs total

CVE-2026-120348	7.3 HIGH	dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection
CVE-2026-120349	7.3 HIGH	dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

IV. Related Vulnerabilities

Same product: XunRuiCMS

Same vendor: dayrui

Same weakness: CWE-89