SQL Injection in XunruiCMS Affecting Dayrui Software
CVE-2026-101018

5.1MEDIUM

Key Information:

Vendor: Dayrui
Status: Xunruicms
Vendor: CVE Published:; 28 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-101018?

A security flaw exists in Dayrui's XunruiCMS, specifically affecting versions up to 4.7.2. The vulnerability occurs within the 'group_all_edit' function of the 'Home.php' file in the Group Editing component. A manipulation of the 'groupid' argument enables attackers to execute SQL injection attacks remotely. As this flaw has been publicly disclosed, it is crucial for users to take immediate action, as potential exploits may be developed by malicious actors. Despite prior attempts to notify the vendor, no response has been received, highlighting a pressing need for vigilance among users.

Affected Version(s)

XunruiCMS 4.7.0

XunruiCMS 4.7.1

XunruiCMS 4.7.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-101018 - Proof of Concept