CVE-2026-120349

dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

dayrui · XunRuiCMS

CVSS v4.0 VULDB

5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.30% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-11-02

Proof-of-concept exploits (1)

• tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.mdRepo stars 0★ · pushed 2026-10-06 · snapshot
  1 file

  reports/2.md

CVE references

• https://vuldb.com/cve/CVE-2026-120349ADVISORY
• https://vuldb.com/submit/1016299ADVISORY
• https://vuldb.com/vuln/429673REFERENCE
• https://vuldb.com/vuln/429673/ctiREFERENCE

References

• CVE Record
• NVD entry

Related

• CVE-2026-120347
• CVE-2026-120348