high
advisory
XunRuiCMS: Remote code injection in Email Template Rendering (CVE-2026-120348)
XunRuiCMS versions up to 4.7.4 are vulnerable to code injection via the _get_tpl_content function in the Email Template Rendering component.
CVE search metadata
CVE search record: CVE-2026-120348. Severity: high. CVSS: 7.3. KEV: no. Product: XunRuiCMS (<= 4.7.4). Brief: XunRuiCMS: Remote code injection in Email Template Rendering (CVE-2026-120348). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xunruicms-rce/
Triage facts
Revision 1- Applicability
- XunRuiCMS (<= 4.7.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 07:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in dayrui XunRuiCMS up to 4.7.4. The function _get_tpl_content in dayrui/Fcms/Library/Notice.php (Email Template Rendering component) is susceptible to code injection. The attack can be initiated remotely. Public exploit code is available. The vendor was contacted but did not respond. The CVSS v3.1 base score is 7.3.