CVE-2025-10210

MEDIUM NUCLEI

chancms < 3.3.0 - SQL Injection via Search Function Key Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-10210 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Nuclei Templates (1)

ChanCMS <= 3.3.0 - SQL Injection
MEDIUMVERIFIEDby Yu_Bao
Shodan: http.html:"ChanCMS"
FOFA: body="ChanCMS"

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.323483
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.323483
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.639777

Scores

CVSS v3 6.3
EPSS 0.0089
EPSS Percentile 76.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
chancms/chancms < 3.3.0
Published Sep 10, 2025
Tracked Since Feb 18, 2026