{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/dayrui/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dayrui:xunruicms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-120348"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XunRuiCMS (\u003c= 4.7.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","rce","vulnerability"],"_cs_type":"advisory","_cs_vendors":["dayrui"],"content_html":"\u003cp\u003eA vulnerability exists in dayrui XunRuiCMS up to 4.7.4. The function _get_tpl_content in dayrui/Fcms/Library/Notice.php (Email Template Rendering component) is susceptible to code injection. The attack can be initiated remotely. Public exploit code is available. The vendor was contacted but did not respond. The CVSS v3.1 base score is 7.3.\u003c/p\u003e\n","date_modified":"2026-11-02T07:17:34Z","date_published":"2026-11-02T07:17:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xunruicms-rce/","summary":"XunRuiCMS versions up to 4.7.4 are vulnerable to code injection via the _get_tpl_content function in the Email Template Rendering component.","title":"XunRuiCMS: Remote code injection in Email Template Rendering (CVE-2026-120348)","url":"https://feed.craftedsignal.io/briefs/2026-11-xunruicms-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Dayrui","version":"https://jsonfeed.org/version/1.1"}