XunRuiCMS EUVD-2026-115070

Exploitation targets the email-template rendering component, specifically the _get_tpl_content function in dayrui/Fcms/Library/Notice.php, and requires the attacker to influence the rendered template content so that injected code is evaluated server-side. The supplied CVSS 4.0 vector claims no privileges and no user interaction (PR:N/UI:N) against network-reachable endpoints, but the sources do not describe how the function is reached or whether editing/supplying a template requires an authenticated administrative session - a strong limiting factor if, as is typical for CMS template handling, template modification is privileged. The precise trigger is not described in the available sources, so defenders should verify whether the template path is reachable pre-authentication in their deployment; no fixed version is listed and the vendor did not respond.

This is a medium-severity issue (CVSS 4.0 base 5.5) that should be treated as a routine, scheduled remediation rather than an emergency, consistent with the vuln.today 'this_month' decision label. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, with low partial impact to confidentiality, integrity and availability (VC:L/VI:L/VA:L) and no scope change. However, these signals conflict: the flaw is code injection (CWE-94) in an email-template rendering function (_get_tpl_content), and template-content control in a CMS is normally an authenticated/administrative capability - so the PR:N rating is questionable and should be verified against the actual reachability of the template function. There is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation; the exploit maturity is marked E:P (proof-of-concept). A public PoC reference exists but it is not verified as working exploit code, so do not treat it as confirmed weaponization. Net: a real but moderate issue driven primarily by the VulDB-assigned vector and a disclosure the vendor ignored - not a high-urgency, broadly-exploited threat on current data.

A remote attacker reaches the email-template rendering path (_get_tpl_content in dayrui/Fcms/Library/Notice.php) and supplies crafted template content containing injected code, which XunRuiCMS then evaluates during rendering, leading to code injection on the server. A public PoC reference exists but is not verified as working exploit code, and the exact trigger and whether prior authentication is required are not described in the available sources. The CVSS rates attack complexity low with no required interaction, but realistic exploitation likely depends on being able to influence template content.