CVE-2026-120349 | dayrui XunRuiCMS up to 4.7.4 Mobile Site Directory index.php str_replace dirname code injection

A vulnerability described as critical has been identified in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection.

This vulnerability is reported as CVE-2026-120349. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More