CVE-20XX-?

CVE-2025-8549

2.9 LOW 0.5% exploit odds Fix listed Auth & access Web app

What it is

A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e5151282926ada54080244d499f. It is recommended to apply a patch to fix this issue.

At a glance

Exploitability
Can be exploited over the network without logging in. Limited direct impact.
Exploit odds
0.5% chance of exploitation in the next 30 days (EPSS).
Fix
A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

  1. PublishedDisclosed publicly on CVE.org and NVD
  2. Last updatedMost recent change to the record

Details

Published
Last modified
Exploit probability
0.5% · EPSS, next 30 days
Weakness
CWE-521
Record status
Analyzed

Affected

Attack profile CVSS 4.0 · 2.9

Attack vector
Network
Complexity
High
Attack requirements
None
Privileges needed
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Raw vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Meme: I wake up, CVE-2025-8549
Download Square Reddit

Fix and advisories

References

NVD record · CVE.org record