CVE-2025-14007: dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting
A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the component Domain Name Binding Page. The manipulation results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14007?
CVE-2025-14007 is a cross site scripting vulnerability that can allow an attacker to execute malicious scripts in the context of a user's browser.
How do I fix CVE-2025-14007?
To fix CVE-2025-14007, it's recommended to upgrade XunRuiCMS to a version newer than 4.7.1 that addresses this vulnerability.
Who is affected by CVE-2025-14007?
CVE-2025-14007 affects all users of dayrui XunRuiCMS versions up to and including 4.7.1.
What component of dayrui XunRuiCMS is vulnerable in CVE-2025-14007?
The vulnerability in CVE-2025-14007 is found in the Domain Name Binding Page component, particularly affecting the file located at /admin79f2ec220c7e.php?c=api&m=demo&name=mobile.
Can CVE-2025-14007 be exploited remotely?
Yes, CVE-2025-14007 can be exploited remotely, allowing attackers to perform cross site scripting attacks without physical access to the affected systems.