# CVE-2026-101018: dayrui XunruiCMS SQL injection in Group Editing

Source: https://junglewise.ai/threats/cve-2026-101018-a-vulnerability-was-determined-in-dayrui-xunruicms-up-to-4-7-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101018 · Severity: medium · CVSS 4.7 · Published 2026-09-28

XunruiCMS is a content management system used to build and manage websites. A SQL injection vulnerability in the group administration feature allows authenticated attackers to extract sensitive data from the database, including usernames, passwords, and other confidential information stored in the system.

Technologies: [Dayrui XunruiCMS](https://junglewise.ai/threats/technologies/dayrui-xunruicms). Vendors: [Dayrui](https://junglewise.ai/threats/vendors/dayrui).

## Quick answers

**Is CVE-2026-101018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101018 being exploited in the wild.

**How severe is CVE-2026-101018?** Medium severity, with a CVSS score of 4.7, published 28 September 2026.

**Which products and versions are affected?** Dayrui XunruiCMS up to 4.7.2.

**Is there a fix for CVE-2026-101018?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101018 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-101018?** Check whether you run Dayrui XunruiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the group_all_edit function within dayrui/App/Member/Controllers/Admin/Home.php where the groupid POST parameter is concatenated directly into a SQL WHERE clause without proper escaping or type constraints. An authenticated attacker can inject SQL commands via the groupid parameter to perform error-based SQL injection and extract database contents. The vulnerability requires prior authentication to the admin panel but allows remote exploitation once access is obtained.

## Affected products

- dayrui XunruiCMS up to 4.7.2

## Timeline

- 2026-09-28: disclosed: Vulnerability publicly disclosed on GitHub

## References

- [https://github.com/FlyFish6-cloud/CVE/blob/main/XunruiCMS-SQL.md](https://github.com/FlyFish6-cloud/CVE/blob/main/XunruiCMS-SQL.md)
- [https://vuldb.com/cve/CVE-2026-101018](https://vuldb.com/cve/CVE-2026-101018)

## Related threats

- [dayrui XunRuiCMS code injection in mobile site directory](https://junglewise.ai/threats/cve-2026-120349-a-security-flaw-has-been-discovered-in-dayrui-xunruicms-up-to-4)
- [dayrui XunRuiCMS code injection in email template rendering](https://junglewise.ai/threats/cve-2026-120348-a-vulnerability-was-identified-in-dayrui-xunruicms-up-to-4-7-4)
- [dayrui XunRuiCMS SQL injection in Member Module](https://junglewise.ai/threats/cve-2026-120347-a-vulnerability-was-determined-in-dayrui-xunruicms-up-to-4-7-4)