CVE-2025-1186 – dayrui XunRuiCMS Api.php deserialization

https://notcve.org/view.php?id=CVE-2025-1186

12 Feb 2025 — A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. • https://github.com/pwysec/d6qRhl/blob/main/1.pdf • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •