CVE-2025-10787: MuYuCMS Add Fiend Link index.html server-side request forgery

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-22 · updated 2026-10-19
Weakness: CWE-918

Description

A vulnerability was found in MuYuCMS up to 2.7. Impacted is an unknown function of the file /index/index.html of the component Add Fiend Link Handler. Performing manipulation of the argument Link URL results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.

Affected products

MuYuCMS: 2.0, 2.1, 2.2, 2.3, 2.4, 2.5 (+2)

References

https://gitee.com/MuYuCMS/MuYuCMS/issues/ICXV34
https://vuldb.com/?ctiid.325144
https://vuldb.com/?id.325144
https://vuldb.com/?submit.653888
https://gitee.com/MuYuCMS/MuYuCMS/issues/ICXV34

Get alerted when CVE-2025-10787 or the next vulnerability affects your stack