CVE-2025-11904: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. This affects the function hasUse of the file /cms/model/hasUse. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2025-11905: Improper Control of Generation of Code

A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2025-11903: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing a manipulation of the argument cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Th...

CVE-2025-11902: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField. Performing a manipulation of the argument cid results in sql injection. The attack can be initiated remotely. The exploit is now public an...

PT-2025-42597

Name of the Vulnerable Software and Affected Versions ChanCMS versions up to 3.3.2 Description A flaw exists in the findField function located in the /cms/article/findField file of ChanCMS. Manipulation of the cid argument can lead to a SQL injection. This issue can be exploited remotely...

PT-2025-42598

Name of the Vulnerable Software and Affected Versions ChanCMS versions up to 3.3.2 Description A flaw exists in the update function of the /cms/article/update file in ChanCMS. Manipulation of the cid argument can lead to SQL injection. The attack can be launched remotely. The exploit has been...

EUVD-2025-27613

Malicious code in bioql PyPI...

EUVD-2025-27186

Malicious code in bioql PyPI...

EUVD-2025-27178

Malicious code in bioql PyPI...

EUVD-2025-27174

Malicious code in bioql PyPI...

EUVD-2025-22816

Malicious code in bioql PyPI...

EUVD-2025-22819

Malicious code in bioql PyPI...

EUVD-2025-27604

Malicious code in bioql PyPI...

EUVD-2025-22863

Malicious code in bioql PyPI...

EUVD-2025-22573

Malicious code in bioql PyPI...

EUVD-2025-22569

Malicious code in bioql PyPI...

EUVD-2025-22817

Malicious code in bioql PyPI...

CVE-2025-10211

A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit ha...

CVE-2025-10210

A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the...

ChanCMS SQL Injection Vulnerability

ChanCMS is a content management system. ChanCMS 3.3.0 and earlier versions suffer from a SQL injection vulnerability, which originates from the lack of validation of the Search parameter key in the app/modules/api/service/Api.js function against external input SQL statements. An attacker can...