CVE-2025-2131 - dayrui XunRuiCMS Friendly Links cross site scripting

Back Back to CVE browser

MEDIUM

dayrui XunRuiCMS Friendly Links cross site scripting

Published Mar 9, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.30%

Description

A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friendly Links Handler. The manipulation of the argument Website Address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Dayrui Product XunRuiCMS Default
n/a
- Version
  4.6.0
  Status
  affected
  Constraints
  -
- Version
  4.6.1
  Status
  affected
  Constraints
  -
- Version
  4.6.2
  Status
  affected
  Constraints
  -
- Version
  4.6.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dayrui

XunRuiCMS

n/a

Version	Status	Constraints
4.6.0	affected	-
4.6.1	affected	-
4.6.2	affected	-
4.6.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (4)

https://github.com/dayrui/xunruicms/issues/7
exploitissue-trackingIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.299051
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.299051
vdb-entrytechnical-descriptionPermissions RequiredVDB Entry
https://vuldb.com/?submit.511411
third-party-advisoryVDB Entry

Link	Providers	Tags
https://github.com/dayrui/xunruicms/issues/7		exploitissue-trackingIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.299051		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.299051		vdb-entrytechnical-descriptionPermissions RequiredVDB Entry
https://vuldb.com/?submit.511411		third-party-advisoryVDB Entry