{"id":"CVE-2025-8547","summary":"atjiu pybbs Email Verification improper authorization","details":"A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 044f22893bee254dc2bb0d30f614913fab3c22c2. It is recommended to apply a patch to fix this issue.","modified":"2026-08-27T09:37:44.152481Z","published":"2025-08-05T05:32:06.564Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-266","CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8547.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8547.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8547"},{"type":"ADVISORY","url":"https://vuldb.com/?id.318676"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.622180"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/200"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/200#issue-3256283647"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/200#issuecomment-3134710486"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.318676"},{"type":"FIX","url":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/atjiu/pybbs","events":[{"introduced":"0"},{"fixed":"044f22893bee254dc2bb0d30f614913fab3c22c2"}],"database_specific":{"cpe":"cpe:2.3:a:pybbs_project:pybbs:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"6.0.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["6.0","v6.0.0","v5.2.1","v5.2.0","v5.1.0","v5.0","pybbs2.6","pybbs4.0-release","pybbs-4.0-beta","pybbs2.5-lastest","pybbs2.5","jfinalbbs2.2","jfinalbbs2.1","jfinalbbs2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8547.json","vanir_signatures_modified":"2026-08-27T09:37:44Z","vanir_signatures":[{"target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java"},"deprecated":false,"digest":{"line_hashes":["72260186787684819731242493767831068954","125545073475123889436619049201871101323","276647992214593633014528853953719882944","259066046771481669383509404357766220021","182295681220274987030622191994189288399","142989983924951979842615873903533803110","160756479885291401276013367738114668902","31385032659353525389222650507711710583","98421024704973361894741141400867097709","327796721381122134201824315819000298234","23911924491088276941748592814249832177","302745522092138265816356348704972595942","174581977891428627131265249462632037902","338535002089620892446528086115992469399"],"threshold":0.9},"id":"CVE-2025-8547-252372d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2"},{"target":{"function":"validateCode","file":"src/main/java/co/yiiu/pybbs/service/impl/CodeService.java"},"deprecated":false,"digest":{"function_hash":"340221891792333169455935261325835417688","length":575},"id":"CVE-2025-8547-5aeff7d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"function":"register","file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"},"deprecated":false,"digest":{"length":1124,"function_hash":"105378245635715453377974886861344066110"},"id":"CVE-2025-8547-6a782e59"},{"target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java","function":"sms_code"},"deprecated":false,"digest":{"length":585,"function_hash":"47273898982143582370278020583779991943"},"id":"CVE-2025-8547-84525029","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/service/ICodeService.java"},"deprecated":false,"digest":{"line_hashes":["127830404568129869183043462225021356622","64092547752248007908817260941718722561","328025031993525501374696172607733540750"],"threshold":0.9},"id":"CVE-2025-8547-884412a1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/service/impl/UserService.java","function":"addUser"},"deprecated":false,"digest":{"function_hash":"276917871289985419065140757090474358292","length":1270},"id":"CVE-2025-8547-8e7584dd"},{"source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/controller/front/IndexController.java"},"deprecated":false,"digest":{"line_hashes":["131522646018878002278003013721898589369","243196340065290500721206529485353087025","316649770634480906091745497719238920419","253013787076598531077230235282867762582","97349502500310091830392223634856244942","294081921680121715538645297734022077841"],"threshold":0.9},"id":"CVE-2025-8547-a97e1043","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["76723877149682928688255746825421922616","208388919086561383610188366875551543494","195760818875294852552442388569510152053","174639165242954012229409073328504384485"],"threshold":0.9},"id":"CVE-2025-8547-a9bb8c64","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/config/service/TelegramBotService.java"},"deprecated":false},{"source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java","function":"sendEmailCode"},"deprecated":false,"digest":{"function_hash":"308047877900723158118716419973481995902","length":399},"id":"CVE-2025-8547-d55e0e5a","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/service/impl/CodeService.java"},"deprecated":false,"digest":{"line_hashes":["293598032414559899620376715281546831154","69248772400445178262673880591506458507","26669180639826526865281674824356613097","685570715400408072982700889981041610","30863223246888311569339444418444557645","243256625682695925978720956862267848350","186820628311866795534266495934482792103","176747188445900175062132814908533477476","29706402037133662402949625190756390355","10650330286339883212896259189146254041","265340016240627415991451534479214967831","277621272375533502195069745564019629426"],"threshold":0.9},"id":"CVE-2025-8547-db04ea47","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-8547-e8c99005","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/service/impl/UserService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["330794854612700946791045477617013098154","206184785229816079754773204111979373124","7434837289469193399673715451747831805","188880267522097176106775130503483152979","124255800369233161269066466280424145658","36688836849995596204565141519684238944","303329758241432744089332090643424576526","53233361900733098483262014601197032088","234009300645792876268686429633524772969","197916739336703778836567817888987449379","36646296441537275507513139158162681515","114523494380206192056511746585136609326","328000664701524579027482453429256202921","249171057432000561686279255649688697259","235567763850914259621317526419366318484","15964018706589760091871772984527796287","259093857433596570448620734804936407192","91364324240183121105507724411720233246"]}},{"digest":{"function_hash":"266768278353083816891504948103419442219","length":1199},"id":"CVE-2025-8547-f6079ad7","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/config/service/TelegramBotService.java","function":"setWebHook"},"deprecated":false},{"target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"},"deprecated":false,"digest":{"line_hashes":["324832636067212938548386872659631373139","123907511977914493257013737406685900931","226278739576943100060488722188727408412","112047849483555749939269006404171681657","227913166031610611192621423560384476178","17186668160972552955023535150608660457","184249026283852991475692973719958244842","250138969961119757247502993840807545373","75897577677763535016974280629363685221","178067933792334498602582857487325353020","214524088895903536853262308722795270192","115307297468760060277738309026938417909","90312167174534657980705709392852925851","44708107126671448054511848969195622498","223007036680525726433681125080793393425","335643274323726116748184947573034924596","77220820622573379335290796058987422542","337918087967121183035039124740189262223","174619651242067582528898936632536118444","91418962545931691248311550646568272928","152325517822721944556987002304903842939","12619998844098592955904562897108524652"],"threshold":0.9},"id":"CVE-2025-8547-fab681ff","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2","target":{"file":"src/main/java/co/yiiu/pybbs/controller/front/IndexController.java","function":"register"},"deprecated":false,"digest":{"function_hash":"156478915843731628311894494997949369537","length":127},"id":"CVE-2025-8547-fc3a72fa"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}]}