CVE-2025-8547

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-8547
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8547.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-8547
Published
2025-08-05T05:32:06Z
Modified
2026-08-27T09:37:44Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
atjiu pybbs Email Verification improper authorization
Details

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 044f22893bee254dc2bb0d30f614913fab3c22c2. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8547.json"
}
References

Affected packages

Git / github.com/atjiu/pybbs

Affected ranges

Type
GIT
Repo
https://github.com/atjiu/pybbs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
044f22893bee254dc2bb0d30f614913fab3c22c2
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pybbs_project:pybbs:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.0
jfinalbbs2.*
jfinalbbs2.0
jfinalbbs2.1
jfinalbbs2.2
pybbs-4.*
pybbs-4.0-beta
pybbs2.*
pybbs2.5
pybbs2.5-lastest
pybbs2.6
pybbs4.*
pybbs4.0-release
v5.*
v5.0
v5.1.0
v5.2.0
v5.2.1
v6.*
v6.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8547.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "72260186787684819731242493767831068954",
                "125545073475123889436619049201871101323",
                "276647992214593633014528853953719882944",
                "259066046771481669383509404357766220021",
                "182295681220274987030622191994189288399",
                "142989983924951979842615873903533803110",
                "160756479885291401276013367738114668902",
                "31385032659353525389222650507711710583",
                "98421024704973361894741141400867097709",
                "327796721381122134201824315819000298234",
                "23911924491088276941748592814249832177",
                "302745522092138265816356348704972595942",
                "174581977891428627131265249462632037902",
                "338535002089620892446528086115992469399"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-252372d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "340221891792333169455935261325835417688",
            "length": 575
        },
        "id": "CVE-2025-8547-5aeff7d8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/service/impl/CodeService.java",
            "function": "validateCode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "105378245635715453377974886861344066110",
            "length": 1124
        },
        "id": "CVE-2025-8547-6a782e59",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java",
            "function": "register"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47273898982143582370278020583779991943",
            "length": 585
        },
        "id": "CVE-2025-8547-84525029",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java",
            "function": "sms_code"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "127830404568129869183043462225021356622",
                "64092547752248007908817260941718722561",
                "328025031993525501374696172607733540750"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-884412a1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/service/ICodeService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "276917871289985419065140757090474358292",
            "length": 1270
        },
        "id": "CVE-2025-8547-8e7584dd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/service/impl/UserService.java",
            "function": "addUser"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "131522646018878002278003013721898589369",
                "243196340065290500721206529485353087025",
                "316649770634480906091745497719238920419",
                "253013787076598531077230235282867762582",
                "97349502500310091830392223634856244942",
                "294081921680121715538645297734022077841"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-a97e1043",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/front/IndexController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "76723877149682928688255746825421922616",
                "208388919086561383610188366875551543494",
                "195760818875294852552442388569510152053",
                "174639165242954012229409073328504384485"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-a9bb8c64",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/config/service/TelegramBotService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "308047877900723158118716419973481995902",
            "length": 399
        },
        "id": "CVE-2025-8547-d55e0e5a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java",
            "function": "sendEmailCode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "293598032414559899620376715281546831154",
                "69248772400445178262673880591506458507",
                "26669180639826526865281674824356613097",
                "685570715400408072982700889981041610",
                "30863223246888311569339444418444557645",
                "243256625682695925978720956862267848350",
                "186820628311866795534266495934482792103",
                "176747188445900175062132814908533477476",
                "29706402037133662402949625190756390355",
                "10650330286339883212896259189146254041",
                "265340016240627415991451534479214967831",
                "277621272375533502195069745564019629426"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-db04ea47",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/service/impl/CodeService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "330794854612700946791045477617013098154",
                "206184785229816079754773204111979373124",
                "7434837289469193399673715451747831805",
                "188880267522097176106775130503483152979",
                "124255800369233161269066466280424145658",
                "36688836849995596204565141519684238944",
                "303329758241432744089332090643424576526",
                "53233361900733098483262014601197032088",
                "234009300645792876268686429633524772969",
                "197916739336703778836567817888987449379",
                "36646296441537275507513139158162681515",
                "114523494380206192056511746585136609326",
                "328000664701524579027482453429256202921",
                "249171057432000561686279255649688697259",
                "235567763850914259621317526419366318484",
                "15964018706589760091871772984527796287",
                "259093857433596570448620734804936407192",
                "91364324240183121105507724411720233246"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-e8c99005",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/service/impl/UserService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "266768278353083816891504948103419442219",
            "length": 1199
        },
        "id": "CVE-2025-8547-f6079ad7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/config/service/TelegramBotService.java",
            "function": "setWebHook"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "324832636067212938548386872659631373139",
                "123907511977914493257013737406685900931",
                "226278739576943100060488722188727408412",
                "112047849483555749939269006404171681657",
                "227913166031610611192621423560384476178",
                "17186668160972552955023535150608660457",
                "184249026283852991475692973719958244842",
                "250138969961119757247502993840807545373",
                "75897577677763535016974280629363685221",
                "178067933792334498602582857487325353020",
                "214524088895903536853262308722795270192",
                "115307297468760060277738309026938417909",
                "90312167174534657980705709392852925851",
                "44708107126671448054511848969195622498",
                "223007036680525726433681125080793393425",
                "335643274323726116748184947573034924596",
                "77220820622573379335290796058987422542",
                "337918087967121183035039124740189262223",
                "174619651242067582528898936632536118444",
                "91418962545931691248311550646568272928",
                "152325517822721944556987002304903842939",
                "12619998844098592955904562897108524652"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8547-fab681ff",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "156478915843731628311894494997949369537",
            "length": 127
        },
        "id": "CVE-2025-8547-fc3a72fa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/front/IndexController.java",
            "function": "register"
        }
    }
]
vanir_signatures_modified 
"2026-08-27T09:37:44Z"