CVE-2026-101018
dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Sep 28, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 27, 2026
Description
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
XunruiCMSdayrui |
|
References
- VDB-410888 | dayrui XunruiCMS Group Editing Home.php group_all_edit sql injectionvdb-entrytechnical-description
- VDB-410888 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-101018 | CVE Analysis and Reportthird-party-advisory
- Submit #922935 | 四川迅睿云软件开发有限公司 XunruiCMS <=4.7.2 SQL Injectionthird-party-advisory
- https://github.com/FlyFish6-cloud/CVE/blob/main/XunruiCMS-SQL.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.