Priority HIGH 67
XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cron.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00924 · Published 2023-03-23 · No fix listed CWE-829
Priority MEDIUM 60
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00228 · Published 2025-10-03 · No fix listed CWE-79
Priority MEDIUM 60
Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00292 · Published 2025-02-20 · No fix listed CWE-79
Priority MEDIUM 58
A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00296 · Published 2025-12-04 · No fix listed CWE-79
Priority MEDIUM 57
A weakness has been identified in dayrui XunRuiCMS up to 4.7.1.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0037 · Published 2025-12-28 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability was found in dayrui XunRuiCMS 4.6.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00725 · Published 2025-02-11 · No fix listed CWE-20
Priority MEDIUM 56
A flaw has been found in dayrui XunRuiCMS up to 4.7.1.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00446 · Published 2025-12-04 · No fix listed CWE-918
Priority MEDIUM 56
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00467 · Published 2025-12-04 · No fix listed CWE-918
Priority MEDIUM 55
A weakness has been identified in dayrui XunRuiCMS up to 4.7.1.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00314 · Published 2025-12-04 · No fix listed CWE-79
Priority MEDIUM 55
A vulnerability was found in dayrui XunRuiCMS up to 4.6.3.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00305 · Published 2025-03-09 · No fix listed CWE-79
Priority MEDIUM 52
xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01578 · Published 2023-09-26 · No fix listed CWE-94
Priority MEDIUM 44
A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1.
CVSS 4.0LOW 2.0· Network · High privileges · User interaction · EPSS 0.00298 · Published 2025-12-04 · No fix listed CWE-79
Priority LOW 38
XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0047 · Published 2022-08-19 · No fix listed CWE-352
Priority LOW 34
A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00685 · Published 2023-03-28 · No fix listed CWE-425
Priority LOW 34
A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00803 · Published 2023-03-28 · No fix listed CWE-200
Priority LOW 34
A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00778 · Published 2023-03-29 · No fix listed CWE-200
Priority LOW 33
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00497 · Published 2023-03-29 · No fix listed CWE-200
Priority LOW 28
Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00583 · Published 2024-04-16 · No fix listed CWE-79
Priority LOW 28
Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00495 · Published 2024-02-02 · No fix listed CWE-79
Priority LOW 28
XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00442 · Published 2023-12-11 · No fix listed CWE-79
Priority LOW 27
A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Column Name parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00308 · Published 2024-03-07 · No fix listed CWE-79
Priority LOW 25
A vulnerability was found in dayrui XunRuiCMS up to 4.6.4.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00685 · Published 2025-02-12 · No fix listed CWE-20
Priority LOW 25
An issue was discovered in XunRuiCMS 4.3.1.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00611 · Published 2019-10-01 · No fix listed CWE-79
THREATIST.IORead the docs