PT-2025-37096

CVE-2025-10211

·

Published

2025-09-10

·

Updated

2025-12-01

Description by

CVSS 2.0
6.5
Medium
MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: ChanCMS version 3.3.0
Description: A security issue has been identified in ChanCMS. The CollectController function within the /cms/collect/getArticle file is susceptible to server-side request forgery (SSRF) through manipulation of the taskUrl argument. This allows for remote attacks. The vulnerability has been publicly disclosed.
Recommendations: As a temporary workaround, consider restricting access to the /cms/collect/getArticle file until a patch is available.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-918: Server-Side Request Forgery (SSRF)
Related identifiers
CVE-2025-10211
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com