CVE-2025-10105

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in yanyutao0402 ChanCMS up to 3.3.1. Affected by this issue is some unknown functionality of the file /cms/article/search. This manipulation of the argument keyword causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
yanyutao0402	ChanCMS	3.3.0; 3.3.1

References

https://github.com/chujianxin0101/vuln/issues/8Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.323072Permissions Required, VDB Entry
https://vuldb.com/?id.323072Third Party Advisory, VDB Entry
https://vuldb.com/?submit.645341Third Party Advisory, VDB Entry

Timeline

Published: Sep 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-101068.8A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.1. This affects an unknown part of the file /cms/collect/search. Such manip CVE-2025-101074.7A vulnerability has been found in TRENDnet TEW-831DR 1.0 (601.130.1.1410). Impacted is an unknown function of the file /boafrm/formSysCmd. T CVE-2025-101089.8A vulnerability was found in Campcodes Online Loan Management System 1.0. This vulnerability affects unknown code of the file /ajax.php?acti CVE-2025-101099.8A vulnerability was determined in Campcodes Online Loan Management System 1.0. This issue affects some unknown processing of the file /ajax.CVE-2025-10118.8A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code CVE-2025-101108.8A vulnerability was identified in ChanCMS up to 3.3.1. Impacted is an unknown function of the file /search/. The manipulation with the input CVE-2025-101119.8A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function o CVE-2025-101129.8A weakness has been identified in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the CVE-2025-101139.8A security vulnerability has been detected in itsourcecode Student Information Management System 1.0. This affects an unknown function of th CVE-2025-101149.8A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The ma CVE-2025-101157.3A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation o CVE-2025-101167.3A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. S