CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2025-1186 – dayrui XunRuiCMS Api.php deserialization
https://notcve.org/view.php?id=CVE-2025-1186
12 Feb 2025 — A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. • https://github.com/pwysec/d6qRhl/blob/main/1.pdf • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2025-1177 – dayrui XunRuiCMS Linkage.php import_add deserialization
https://notcve.org/view.php?id=CVE-2025-1177
11 Feb 2025 — A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Admin/Linkage.php. The manipulation leads to deserialization. It is possible to launch the attack remotely. • https://github.com/stevenchen0x01/CVE2/blob/main/cve2.md • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •