Threats tagged 'ghsa-5r35-w63q-rcr8'

A code injection vulnerability exists in dayrui XunRuiCMS up to version 4.7.4 in the Mobile Site Directory component. The flaw is due to improper handling of the dirname argument in the str_replace function within /var/www/html/zzmob/index.php. This vulnerability can be exploited remotely without authentication. Public exploit code is available, and the vendor has not responded to disclosure attempts.