XunRuiCMS EUVD-2026-115071

The target must expose the Mobile Site Directory component at /zzmob/index.php, and the attacker must be able to control the 'dirname' argument that reaches the str_replace sink. Per the supplied CVSS 4.0 vector the attack is remote and unauthenticated (PR:N) with no user interaction (UI:N) and low complexity (AC:L/AT:N), implying default-configuration reachability - but this is VulDB-asserted and not vendor-confirmed. Limiting factors: exploitation requires the zzmob mobile-site feature to be present/enabled, impacts are rated only Low across confidentiality/integrity/availability, and the only released exploit is an unverified PoC reference rather than confirmed working code; no fixed version exists because the vendor did not respond.

The single CVSS signal available is a CVSS 4.0 base score of 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and uniformly Low vulnerable-system impacts (VC:L/VI:L/VA:L), carrying E:P (proof-of-concept exploit maturity). There is no EPSS score and no CISA KEV listing in the supplied data, so there is no quantitative exploitation-probability signal and no evidence of active, in-the-wild exploitation. The vuln.today decision label is 'this_month', i.e. a moderate-priority item, not act_now or emergency. A notable internal tension exists: the CWE is CWE-94 (code injection), a class that normally yields high integrity/confidentiality/availability impact, yet the supplied vector rates all three impacts only Low - this mismatch should be verified, as either the impact rating is conservative or the 'code injection' label overstates a more limited string-manipulation flaw. The only vendor-interaction fact is that the vendor (dayrui) was contacted and did not respond, so no vendor confirmation or patch exists. Net: this reads as a VulDB-sourced, medium-severity disclosure on a niche CMS with a PoC reference but no confirmed working exploit, no EPSS, and no KEV - a real but non-urgent issue rather than a widespread emergency.

A remote attacker sends a crafted request to the Mobile Site Directory endpoint (/zzmob/index.php), manipulating the 'dirname' argument that is passed to a str_replace operation to inject code (CWE-94). Per the CVSS vector no authentication or user interaction is required (PR:N/UI:N), though the rated impacts are only Low. A public PoC reference exists (a disclosure report on GitHub), but it is not verified as working exploit code, so reliable exploitation is not confirmed.