CVE-2026-101018: dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires high privileges (PR:H) and can be performed remotely without user interaction. The affected functionality is the administrative Group Editing component.
Which versions are affected?
dayrui XunRuiCMS versions up to and including 4.7.2 are reported as affected. No fixed version is identified in the provided information.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What should teams do if they cannot patch immediately?
Restrict access to administrative Group Editing functionality to only trusted high-privilege users, since exploitation targets the groupid argument in group_all_edit. Monitor administrative use of this function for unexpected or suspicious group identifier values.