Dayrui - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/dayrui/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 07:17:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXunRuiCMS: Remote code injection in Email Template Rendering (CVE-2026-120348)https://feed.craftedsignal.io/briefs/2026-11-xunruicms-rce/Mon, 02 Nov 2026 07:17:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xunruicms-rce/XunRuiCMS versions up to 4.7.4 are vulnerable to code injection via the _get_tpl_content function in the Email Template Rendering component.<p>A vulnerability exists in dayrui XunRuiCMS up to 4.7.4. The function _get_tpl_content in dayrui/Fcms/Library/Notice.php (Email Template Rendering component) is susceptible to code injection. The attack can be initiated remotely. Public exploit code is available. The vendor was contacted but did not respond. The CVSS v3.1 base score is 7.3.</p> highadvisoryweb-applicationrcevulnerability