CVE-2025-15144

Name of the Vulnerable Software and Affected Versions dayrui XunRuiCMS versions up to 4.7.1

Description A flaw exists in dayrui XunRuiCMS that allows for cross site scripting. The issue is located in the JSONP Callback Handler component, specifically within the dr show error/dr exit msg function of the /dayrui/Fcms/Init.php file. Manipulation of the callback argument can trigger the flaw. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 4.7.1 should be updated.