CVE-2025-10210Medium· 6.3▾ TwilightPoC availableA weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launc…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.3%
1.3% → 1.3%
Nuclei ×1 (last check)
A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
chancms <= 3.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11903Medium· 6.3A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-11904Medium· 6.3A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-11902Medium· 6.3A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-11905Medium· 6.3A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-11342Medium· 4.7A weakness has been identified in code-projects Online Course Registration 1.0
CVE-2025-11343High· 7.3A security vulnerability has been detected in code-projects Student Crud Operation 3.3