PT-2025-31903 · Unknown · Atjiu Pybbs

Zast.Ai · Published 2025-08-05 · Updated 2025-08-05 · CVE-2025-8546

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions atjiu pybbs versions up to 6.0.0

Description A problematic issue exists in the Verification Code Handler component’s adminlogin/login function, leading to guessable captcha. This allows for remote exploitation. The exploit has been publicly disclosed.

Recommendations Apply the patch ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-804

CWE-287

Related Identifiers

CVE-2025-8546

Affected Products

Atjiu Pybbs

References · 12

• 🔥 https://github.com/atjiu/pybbs/issues/199 · Exploit
• 🔥 https://github.com/atjiu/pybbs/issues/199#issue-3256276118 · Exploit
• https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-8546 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8546 · Vendor Advisory
• https://github.com/atjiu/pybbs/issues/199#issuecomment-3134573731 · Note
• https://vuldb.com/?id.318675 · Note
• https://t.me/cveNotify/130873 · Telegram Post
• https://vuldb.com/?submit.622179 · Note
• https://t.me/CVEtracker/29179 · Telegram Post
• https://twitter.com/CVEnew/status/1952609014702854571 · Twitter Post
• https://vuldb.com/?ctiid.318675 · Note