Log in Start free

Vulnerability · Published Sep 10, 2025 · Assigned by VulDB

CVE-2025-10210yanyutao0402 ChanCMS Api.js search sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in ChanCMS from yanyutao0402. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.3%top 28.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei

Official description

A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
yanyutao0402 ChanCMS 3.03.13.23.3.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References