PT-2025-38694 · Muyucms · Muyucms

Eurekya · Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-10787

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MuYuCMS versions prior to 2.7

Description A server-side request forgery condition exists in MuYuCMS. The issue is located in an unknown function within the /index/index.html file of the Add Fiend Link Handler component. Manipulation of the Link URL argument can trigger the issue, allowing for remote attacks. The exploit has been publicly released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10787

Affected Products

Muyucms

References · 7

• 🔥 https://gitee.com/MuYuCMS/MuYuCMS/issues/ICXV34 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10787 · Security Note
• https://twitter.com/CVEnew/status/1970028473734271206 · Twitter Post
• https://vuldb.com/?id.325144 · Note
• https://vuldb.com/?ctiid.325144 · Note
• https://t.me/CVEtracker/33036 · Telegram Post
• https://vuldb.com/?submit.653888 · Note