high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-120348

A high‑severity code injection flaw exists in the Email Template Rendering component of Dayrui XunRuiCMS up to version 4.7.4. The flaw allow

Overview

A high‑severity code injection flaw exists in the Email Template Rendering component of Dayrui XunRuiCMS up to version 4.7.4. The flaw allows remote attackers to inject arbitrary code via the _get_tpl_content function. It can be exploited without authentication, making it a significant risk for sites running affected versions.

Description

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The vulnerability compromises confidentiality, integrity, and availability of the CMS. Attackers can execute arbitrary code, potentially taking full control of the web server. Defenders should consider the risk to all sites hosting the affected CMS.

Remediation

Apply the vendor’s patch or upgrade to XunRuiCMS 4.7.5 or later. If an update is not immediately possible, restrict access to the /dayrui/Fcms/Library/Notice.php endpoint, disable remote template rendering, or implement a web‑application firewall rule to block suspicious payloads.

Risk context

Severity is high with a CVSS v3 score of 7.3. No EPSS data is available, but the public exploit and lack of vendor response elevate the urgency for defenders to patch or mitigate promptly.

Affected products

  • Dayrui XunRuiCMS 4.7.4 and earlier

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

code-injection remote-execution CMS XunRuiCMS high-severity web-application

← All CVEs

Related CVEs

high

CVE-2026-107457

A memory corruption flaw exists in Qt's QMqttClient class when handling certain MQTT 5 connection settings. The bug can corrupt heap memory, leading to application crashes. It affects any application using the Qt MQTT module with MQTT 5 enabled.

View analysis

high

CVE-2026-117518

CVE-2026-117518 affects the @fastify/reply-from plugin, allowing unauthenticated requests to bypass proxy path restrictions via backslash dot-segments. This can expose unintended upstream endpoints. The vulnerability is high severity.

View analysis

high

CVE-2026-120347

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.

View analysis

high

CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.

View analysis