A vulnerability described as critical has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function
Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection.
This vulnerability is tracked as CVE-2025-10210. The attack can be launched remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
