CVE-2025-10211CWE-918ssrf

CVE-2025-10211

Medium · published September 11, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00721 · 53.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-11T00:15Z
Affected products (1)
ProductVersionsFixed in
chancms/chancmsall versions—
References (5)
https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e7.md · [email protected]https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e7.md#poc · [email protected]https://vuldb.com/?ctiid.323484 · [email protected]https://vuldb.com/?id.323484 · [email protected]https://vuldb.com/?submit.639779 · [email protected]
EPSS history
Timeline
  • 10 SEP 20:02Z
    yanyutao0402 ChanCMS getArticle CollectController server-side request forgery
    cvelistv5