CVE-2026-120349 dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function strreplace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched...