Xunruicms
Monthly
SQL injection in dayrui XunruiCMS up to version 4.7.2 lets an authenticated administrator inject arbitrary SQL through the groupid argument of the group_all_edit function in the backend Group Editing feature (dayrui/App/Member/Controllers/Admin/Home.php). Because the vulnerable code sits in an Admin controller and the assessed vector carries PR:H, exploitation requires a valid high-privilege backend session; once that is held, the attack is fully remote with no user interaction. Publicly available exploit code exists (a proof-of-concept is published on GitHub), which places real but contextual risk on deployments where administrator credentials are weak, shared, or already compromised, and the vendor did not respond to disclosure, so no fixed version is available.
Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.
Server-side request forgery in dayrui XunRuiCMS up to 4.7.1 allows authenticated administrators to force the server to make arbitrary network requests via the ‘v’ parameter in the Project Domain Change Test API endpoint. Exploit code is publicly available, but exploitation requires high privileges, significantly limiting real-world risk.
Cross-site scripting (XSS) vulnerability in XunRuiCMS up to 4.7.1 allows authenticated high-privileged attackers to inject arbitrary scripts via the domain name binding page. The attack requires high complexity and user interaction, reducing realistic exploitation risk. A public exploit exists but active exploitation is not confirmed (not in KEV) and EPSS score is low.
Cross-site scripting in XunRuiCMS up to 4.7.1 allows remote attackers to inject arbitrary web script via the data[name] parameter in the Add Data Validation Page. The vulnerability requires low-privileged access and user interaction to trigger. Publicly available exploit code exists, but no active exploitation has been confirmed (EPSS 0.04%).
Stored cross-site scripting in XunRuiCMS 4.7.1 and earlier allows authenticated administrators to inject arbitrary JavaScript via the 'data[name]' parameter in the Add Display Name Field component. A public proof-of-concept exploit exists, but active exploitation has not been confirmed and EPSS estimates a low probability of exploitation.
Server-side request forgery in XunRuiCMS up to 4.7.1 allows authenticated high-privilege attackers to make arbitrary server-side requests via the Email Setting Handler. A publicly available proof-of-concept exists, but exploitation requires administrative access to the CMS admin panel. No active exploitation has been confirmed and EPSS indicates a very low likelihood of widespread exploitation.
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when the uploaded file is viewed.
A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in dayrui XunRuiCMS 4.6.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Column Name parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61.html. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in XunRuiCMS 4.3.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in dayrui XunruiCMS up to version 4.7.2 lets an authenticated administrator inject arbitrary SQL through the groupid argument of the group_all_edit function in the backend Group Editing feature (dayrui/App/Member/Controllers/Admin/Home.php). Because the vulnerable code sits in an Admin controller and the assessed vector carries PR:H, exploitation requires a valid high-privilege backend session; once that is held, the attack is fully remote with no user interaction. Publicly available exploit code exists (a proof-of-concept is published on GitHub), which places real but contextual risk on deployments where administrator credentials are weak, shared, or already compromised, and the vendor did not respond to disclosure, so no fixed version is available.
Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.
Server-side request forgery in dayrui XunRuiCMS up to 4.7.1 allows authenticated administrators to force the server to make arbitrary network requests via the ‘v’ parameter in the Project Domain Change Test API endpoint. Exploit code is publicly available, but exploitation requires high privileges, significantly limiting real-world risk.
Cross-site scripting (XSS) vulnerability in XunRuiCMS up to 4.7.1 allows authenticated high-privileged attackers to inject arbitrary scripts via the domain name binding page. The attack requires high complexity and user interaction, reducing realistic exploitation risk. A public exploit exists but active exploitation is not confirmed (not in KEV) and EPSS score is low.
Cross-site scripting in XunRuiCMS up to 4.7.1 allows remote attackers to inject arbitrary web script via the data[name] parameter in the Add Data Validation Page. The vulnerability requires low-privileged access and user interaction to trigger. Publicly available exploit code exists, but no active exploitation has been confirmed (EPSS 0.04%).
Stored cross-site scripting in XunRuiCMS 4.7.1 and earlier allows authenticated administrators to inject arbitrary JavaScript via the 'data[name]' parameter in the Add Display Name Field component. A public proof-of-concept exploit exists, but active exploitation has not been confirmed and EPSS estimates a low probability of exploitation.
Server-side request forgery in XunRuiCMS up to 4.7.1 allows authenticated high-privilege attackers to make arbitrary server-side requests via the Email Setting Handler. A publicly available proof-of-concept exists, but exploitation requires administrative access to the CMS admin panel. No active exploitation has been confirmed and EPSS indicates a very low likelihood of widespread exploitation.
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when the uploaded file is viewed.
A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in dayrui XunRuiCMS 4.6.3. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Column Name parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61.html. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in XunRuiCMS 4.3.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.