CVE-2025-8227

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The...

CVE-2025-8227

ChanCMS (by yanyutao0402) versions up to 3.1.2 contain a vulnerability in the /collect/getArticle functionality where manipulating the taskUrl parameter leads to deserialization. The issue allows remote execution with no user interaction and is publicly exploitable according to the sources. ChanC...

CVE-2025-8227 yanyutao0402 ChanCMS getArticle deserialization

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The...

CVE-2025-8227 yanyutao0402 ChanCMS getArticle deserialization

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The...

CVE-2025-8226

CVE-2025-8226 affects yanyutao0402 ChanCMS up to version 3.1.2. The vulnerability lies in an unknown function in /sysApp/find where manipulation of accessKey/secretKey leads to information disclosure. It is exploitable remotely and exploits have been publicly disclosed. Remediation: upgrade to Ch...

CVE-2025-8133 yanyutao0402 ChanCMS gather.js getArticle server-side request forgery

A vulnerability classified as critical has been found in yanyutao0402 ChanCMS up to 3.1.2. This affects the function getArticle of the file app/modules/api/service/gather.js. The manipulation of the argument targetUrl leads to server-side request forgery. It is possible to initiate the attack...

CVE-2025-8132 yanyutao0402 ChanCMS utils.js delfile path traversal

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/extend/utils.js. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public...

PT-2025-30729 · Chancms · Chancms

Name of the Vulnerable Software and Affected Versions: ChanCMS versions up to 3.1.2 Description: A critical issue exists in ChanCMS that allows for server-side request forgery. The getArticle function within the app/modules/api/service/gather.js file is susceptible to manipulation via the targetU...