Xunruicms is a content-management system product that, despite a narrow product footprint, occupies a more prominent position in the vulnerability landscape than its size might suggest. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity across its disclosure history. The exposure recurs consistently through application-layer weakness classes including cross-site scripting, code injection, deserialization of untrusted data, and sensitive information exposure, reflecting the parsing and template-rendering attack surface typical of web-facing CMS platforms. Defenders tracking this CMS should prioritize input-sanitization and serialization-safety patches, particularly for internet-exposed instances. Current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xunruicms over time
Signals from CVEs in this vendor scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-14004CRITICAL A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the component Email Setting | Dec 4, 2025 | 9.8 | 30 | NO | NO |
CVE-2021-38243CRITICAL xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a craf | Sep 27, 2023 | 9.8 | 28 | NO | NO |
CVE-2025-1186CRITICAL A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulat | Feb 12, 2025 | 9.8 | 27 | NO | NO |
CVE-2025-1177CRITICAL A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Admin/Linkage.php. The | Feb 11, 2025 | 9.8 | 27 | NO | NO |
CVE-2022-36224HIGH XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). | Aug 19, 2022 | 8.8 | 27 | NO | NO |
CVE-2025-14008HIGH A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api&m=test_site_domain of the component Project D | Dec 4, 2025 | 7.2 | 24 | NO | NO |
CVE-2023-1680HIGH A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manip | Mar 29, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-1682HIGH A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.tx | Mar 29, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-1681HIGH A vulnerability, which was classified as problematic, was found in Xunrui CMS 4.61. Affected is an unknown function of the file /config/myfield/test.php. The manipulation leads to | Mar 28, 2023 | 7.5 | 24 | NO | NO |
CVE-2022-30037HIGH XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cron.php. | Mar 23, 2023 | 7.2 | 23 | NO | NO |
Signals from CVEs in this vendor scope (23 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xunruicms.
Media articles that mention a CVE ID that affects a product developed by Xunruicms — matched by CVE ID, not by vendor name.