CVE-2025-8813

LOW

pybbs < 6.0.0 - Open Redirect via Referer Parameter in changeLanguage Function

Title source: llm
STIX 2.1

Description

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.319342
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.319342
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.622333
Exploit, Issue Tracking issue-tracking
https://github.com/atjiu/pybbs/issues/210
Exploit, Issue Tracking exploit issue-tracking
https://github.com/atjiu/pybbs/issues/210#issue-3256474679

Scores

CVSS v3 3.5
EPSS 0.0027
EPSS Percentile 18.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (1)
pybbs_project/pybbs < 6.0.0
Published Aug 10, 2025
Tracked Since Feb 18, 2026