PT-2025-31910 · Unknown · Atjiu Pybbs

Zast.Ai · Published 2025-08-05 · Updated 2025-08-05 · CVE-2025-8549

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions atjiu pybbs versions up to 6.0.0

Description A critical issue exists in atjiu pybbs up to version 6.0.0 related to weak password requirements in the update function of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. Additionally, a cross site scripting issue affects an unknown functionality in the file /admin/topic/list, triggered by manipulating the Username argument. Both issues are remotely exploitable, and exploits have been publicly disclosed.

Recommendations Apply patch d09cb19a8e7d7e5151282926ada54080244d499f to address the weak password requirements. Apply patch 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22 to address the cross site scripting issue.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2025-8549

Affected Products

Atjiu Pybbs

References · 12

• 🔥 https://github.com/atjiu/pybbs/issues/201#issuecomment-3134733216 · Exploit
• 🔥 https://github.com/atjiu/pybbs/issues/201#issue-3256288016 · Exploit
• 🔥 https://github.com/atjiu/pybbs/issues/201 · Exploit
• https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f · Patch
• https://osv.dev/vulnerability/CVE-2025-8549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8549 · Security Note
• https://vuldb.com/?submit.622187 · Note
• https://vuldb.com/?id.318678 · Note
• https://vuldb.com/?ctiid.318678 · Note
• https://t.me/cveNotify/130880 · Telegram Post
• https://twitter.com/CVEnew/status/1952625420031160799 · Twitter Post
• https://t.me/CVEtracker/29186 · Telegram Post