chancms records
16 published records for vendor chancms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 37.5%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')8
- CWE-918 Server-Side Request Forgery (SSRF)3
- CWE-20 Improper Input Validation2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
16 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2025-65602No exploit | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crachancms · chancms · CWE-94 | Critical9.8 | — | 0.5% | Dec 10, 2025 |
8Monitor | CVE-2025-10210Proof of concept | yanyutao0402 ChanCMS Api.js search sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 1.3% | Sep 10, 2025 |
8Monitor | CVE-2025-8266Proof of concept | yanyutao0402 ChanCMS collect.js getArticle deserializationchancms · chancms · CWE-20 | Low2.1 | — | 1.0% | Jul 28, 2025 |
8Monitor | CVE-2025-11905No exploit | yanyutao0402 ChanCMS gather.js getArticle code injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.8% | Oct 17, 2025 |
8Monitor | CVE-2025-10211Proof of concept | yanyutao0402 ChanCMS getArticle CollectController server-side request forgerychancms · chancms · CWE-918 | Low2.1 | — | 0.7% | Sep 10, 2025 |
8Monitor | CVE-2025-8227No exploit | yanyutao0402 ChanCMS getArticle deserializationchancms · chancms · CWE-20 | Low2.1 | — | 0.6% | Jul 27, 2025 |
8Monitor | CVE-2025-8228No exploit | yanyutao0402 ChanCMS getPages server-side request forgerychancms · chancms · CWE-918 | Low2.1 | — | 0.6% | Jul 27, 2025 |
8Monitor | CVE-2025-8226No exploit | yanyutao0402 ChanCMS find information disclosurechancms · chancms · CWE-200 | Low2.1 | — | 0.6% | Jul 27, 2025 |
8Monitor | CVE-2025-11904No exploit | yanyutao0402 ChanCMS hasUse sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.6% | Oct 17, 2025 |
8Monitor | CVE-2025-11902No exploit | yanyutao0402 ChanCMS findField sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.6% | Oct 17, 2025 |
8Monitor | CVE-2025-11903No exploit | yanyutao0402 ChanCMS update sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.6% | Oct 17, 2025 |
8Monitor | CVE-2025-8132No exploit | yanyutao0402 ChanCMS utils.js delfile path traversalchancms · chancms · CWE-22 | Low2.1 | — | 0.6% | Jul 25, 2025 |
8Monitor | CVE-2025-8133No exploit | yanyutao0402 ChanCMS gather.js getArticle server-side request forgerychancms · chancms · CWE-918 | Low2.1 | — | 0.3% | Jul 25, 2025 |
8Monitor | CVE-2025-10106No exploit | yanyutao0402 ChanCMS search sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.3% | Sep 8, 2025 |
8Monitor | CVE-2025-10105No exploit | yanyutao0402 ChanCMS search sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.3% | Sep 8, 2025 |
8Monitor | CVE-2025-10110No exploit | ChanCMS search sql injectionchancms · chancms · CWE-74 | Low2.1 | — | 0.3% | Sep 8, 2025 |
- CVE-2025-6560239Monitor
A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a cra
CriticalCVSS 9.8No exploitEPSS 0%chancms · chancmsDec 10, 2025
- CVE-2025-102108Monitor
yanyutao0402 ChanCMS Api.js search sql injection
LowCVSS 2.1Proof of conceptEPSS 1%chancms · chancmsSep 10, 2025
- CVE-2025-82668Monitor
yanyutao0402 ChanCMS collect.js getArticle deserialization
LowCVSS 2.1Proof of conceptEPSS 1%chancms · chancmsJul 28, 2025
- CVE-2025-119058Monitor
yanyutao0402 ChanCMS gather.js getArticle code injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsOct 17, 2025
- CVE-2025-102118Monitor
yanyutao0402 ChanCMS getArticle CollectController server-side request forgery
LowCVSS 2.1Proof of conceptEPSS 0%chancms · chancmsSep 10, 2025
- CVE-2025-82278Monitor
yanyutao0402 ChanCMS getArticle deserialization
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsJul 27, 2025
- CVE-2025-82288Monitor
yanyutao0402 ChanCMS getPages server-side request forgery
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsJul 27, 2025
- CVE-2025-82268Monitor
yanyutao0402 ChanCMS find information disclosure
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsJul 27, 2025
- CVE-2025-119048Monitor
yanyutao0402 ChanCMS hasUse sql injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsOct 17, 2025
- CVE-2025-119028Monitor
yanyutao0402 ChanCMS findField sql injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsOct 17, 2025
- CVE-2025-119038Monitor
yanyutao0402 ChanCMS update sql injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsOct 17, 2025
- CVE-2025-81328Monitor
yanyutao0402 ChanCMS utils.js delfile path traversal
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsJul 25, 2025
- CVE-2025-81338Monitor
yanyutao0402 ChanCMS gather.js getArticle server-side request forgery
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsJul 25, 2025
- CVE-2025-101068Monitor
yanyutao0402 ChanCMS search sql injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsSep 8, 2025
- CVE-2025-101058Monitor
yanyutao0402 ChanCMS search sql injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsSep 8, 2025
- CVE-2025-101108Monitor
ChanCMS search sql injection
LowCVSS 2.1No exploitEPSS 0%chancms · chancmsSep 8, 2025