XunRuiCMS CVE-2026-120347

Exploitation requires reaching the Member Module code path served by the View function in dayrui/Fcms/Core/View.php and supplying attacker-controlled input through the 'catid' argument on an instance running XunRuiCMS 4.7.4 or earlier. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated, so the request can be made remotely against a vulnerable instance; however, the 'Member Module' designation may mean the vulnerable endpoint is exposed only where the member/membership functionality is enabled and reachable, and the precise trigger (how catid reaches the query) is not detailed beyond the parameter name in the available sources. The main limiting factors are the niche deployment of this CMS and the need to hit the specific member-module endpoint; impact is bounded to Low on confidentiality, integrity, and availability rather than full system or database takeover.

This is a moderate-severity SQL injection (CWE-89) in XunRuiCMS, reported solely by VulDB with a CVSS 4.0 score of 6.9. The supplied vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity flaw with no authentication required, but impact is limited to Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change - consistent with injection into a single query rather than full database compromise. The vendor priority label is 'this_month', not an emergency, and the exploit maturity in the vector is E:P (proof-of-concept), aligning with the intelligence that only a PoC reference exists rather than verified working exploit code. There is no CISA KEV listing and no EPSS score was provided, so there is no signal of active or widespread exploitation; this reads as a real but non-urgent issue typical of VulDB-sourced disclosures. One caveat: the affected component is the 'Member Module', which could imply a member/login context, yet the vector states PR:N (unauthenticated) - this potential tension between the module name and the no-privileges metric should be verified against the actual code path and the vendor patch before treating it as reliably pre-authentication.

A remote attacker sends a request to the XunRuiCMS Member Module endpoint handled by the View function in dayrui/Fcms/Core/View.php, supplying a crafted value in the 'catid' parameter that breaks out of the intended SQL query. Because the CVSS vector reports no required privileges or user interaction, the request can be issued directly over the network to extract or manipulate limited database content. A public PoC reference exists but is not verified as working exploit code.