CVE-2025-8548

LOW

pybbs < 6.0.0 - Information Exposure via Email Error Message

Title source: llm
STIX 2.1

Description

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.318677
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.318677
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.622186
Exploit, Issue Tracking issue-tracking
https://github.com/atjiu/pybbs/issues/202
Exploit, Issue Tracking exploit issue-tracking
https://github.com/atjiu/pybbs/issues/202#issue-3256293499

Scores

CVSS v3 3.7
EPSS 0.0043
EPSS Percentile 34.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-209
Status published
Products (1)
pybbs_project/pybbs < 6.0.0
Published Aug 05, 2025
Tracked Since Feb 18, 2026