{"id":"CVE-2025-8546","summary":"atjiu pybbs Verification Code login Captcha","details":"A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. It is recommended to apply a patch to fix this issue.","modified":"2026-08-27T09:37:44.777467Z","published":"2025-08-05T05:02:06.125Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-287","CWE-804"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8546.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8546.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8546"},{"type":"ADVISORY","url":"https://vuldb.com/?id.318675"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.622179"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/199"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/199#issue-3256276118"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/199#issuecomment-3134573731"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.318675"},{"type":"FIX","url":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/atjiu/pybbs","events":[{"introduced":"0"},{"fixed":"ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf"}],"database_specific":{"cpe":"cpe:2.3:a:pybbs_project:pybbs:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"6.0.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["6.0","v6.0.0","v5.2.1","v5.2.0","v5.1.0","v5.0","pybbs2.6","pybbs4.0-release","pybbs-4.0-beta","pybbs2.5-lastest","pybbs2.5","jfinalbbs2.2","jfinalbbs2.1","jfinalbbs2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8546.json","vanir_signatures_modified":"2026-08-27T09:37:44Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java","function":"mobile_login"},"deprecated":false,"digest":{"function_hash":"276743334007744017902053742324071721802","length":785},"id":"CVE-2025-8546-14b70833","signature_type":"Function"},{"target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java","function":"login"},"deprecated":false,"digest":{"function_hash":"135191518287035039097528222664422836116","length":710},"id":"CVE-2025-8546-299b1c67","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf"},{"signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java","function":"sms_code"},"deprecated":false,"digest":{"length":551,"function_hash":"46327806450676146831567952480689153304"},"id":"CVE-2025-8546-49b8b211","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["126527644860276446337381431592199952523","273332153779206055292416274820885089374","38012844428037570167033565766038827976","191450388573280106713810687221831097816"],"threshold":0.9},"id":"CVE-2025-8546-5aa743a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf","target":{"file":"src/main/java/co/yiiu/pybbs/controller/admin/IndexAdminController.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf","target":{"function":"adminlogin","file":"src/main/java/co/yiiu/pybbs/controller/admin/IndexAdminController.java"},"deprecated":false,"digest":{"function_hash":"60251454109088619925195501129293701462","length":1241},"id":"CVE-2025-8546-6aba916d"},{"signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"},"deprecated":false,"digest":{"line_hashes":["328445987428086373017268624733112158001","109784412480779051337101059306053359340","241183476973406150198480825181775737780","86925429786499811427571154861111471647","226278739576943100060488722188727408412","37254563766456208976450029161654515289","241183476973406150198480825181775737780","86925429786499811427571154861111471647","337918087967121183035039124740189262223","276414785252259904576030703926613690877","330933201389344601391100972082813697836","176031941788024583912373069464867901678","121223203452740804777616182453163328966","260888233190188414777836060477734171937","241183476973406150198480825181775737780","176031941788024583912373069464867901678"],"threshold":0.9},"id":"CVE-2025-8546-9ee7cb75","signature_type":"Line"},{"deprecated":false,"digest":{"length":1090,"function_hash":"67677807524966652656517846223949961432"},"id":"CVE-2025-8546-e0326531","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java","function":"register"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}