critical·Product Based Web Vulnerabilities·Updated Feb 22, 2026

ChanCMS <= 3.1. - Remote Code Execution

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

2.5k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2025-8266

5.3

CVSSmedium

Exploitable remotely over the internet · low-privilege account sufficient.

Description

A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the file app/modules/cms/controller/collect.js. The manipulation of the argument targetUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.

Attack Vector

Network

Privileges Req.

Low

User Interaction

None

Affected

ChanCMSby yanyutao0402

3.1.0

Updated Sep 18, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

ChanCMS <= 3.1. - Remote Code Execution

Check your infrastructure.Right now.

Check your infrastructure.
Right now.