CVE-2025-8549 — LOW (3.7) — White Hats Nepal

Q: How severe is CVE-2025-8549?

CVE-2025-8549 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2025-8549?

Check the references section above for vendor advisories and patch information. Affected products include: Pybbs Project Pybbs.

Vulnerability Description

A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e5151282926ada54080244d499f. It is recommended to apply a patch to fix this issue.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Pybbs Project	Pybbs	<= 6.0.0

Related Weaknesses (CWE)

CWE-521

References

https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499fPatch
https://github.com/atjiu/pybbs/issues/201ExploitIssue Tracking
https://github.com/atjiu/pybbs/issues/201#issue-3256288016ExploitIssue Tracking
https://github.com/atjiu/pybbs/issues/201#issuecomment-3134733216Issue Tracking
https://vuldb.com/?ctiid.318678Permissions RequiredVDB Entry
https://vuldb.com/?id.318678Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.622187Third Party AdvisoryVDB Entry
https://github.com/atjiu/pybbs/issues/201ExploitIssue Tracking
https://github.com/atjiu/pybbs/issues/201#issue-3256288016ExploitIssue Tracking
https://github.com/atjiu/pybbs/issues/201#issuecomment-3134733216Issue Tracking

FAQ

What is CVE-2025-8549?

CVE-2025-8549 is a vulnerability with a CVSS score of 3.7 (LOW). A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.j...

How severe is CVE-2025-8549?

CVE-2025-8549 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-8549?

Check the references section above for vendor advisories and patch information. Affected products include: Pybbs Project Pybbs.