{"id":"CVE-2025-8549","summary":"atjiu pybbs UserAdminController.java update weak password","details":"A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e5151282926ada54080244d499f. It is recommended to apply a patch to fix this issue.","modified":"2026-08-27T09:37:43.224681Z","published":"2025-08-05T06:32:06.410Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-521"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8549.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8549.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8549"},{"type":"ADVISORY","url":"https://vuldb.com/?id.318678"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.622187"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/201"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/201#issue-3256288016"},{"type":"REPORT","url":"https://github.com/atjiu/pybbs/issues/201#issuecomment-3134733216"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.318678"},{"type":"FIX","url":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/atjiu/pybbs","events":[{"introduced":"0"},{"fixed":"d09cb19a8e7d7e5151282926ada54080244d499f"}],"database_specific":{"cpe":"cpe:2.3:a:pybbs_project:pybbs:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"6.0.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["6.0","v6.0.0","v5.2.1","v5.2.0","v5.1.0","v5.0","pybbs2.6","pybbs4.0-release","pybbs-4.0-beta","pybbs2.5-lastest","pybbs2.5","jfinalbbs2.2","jfinalbbs2.1","jfinalbbs2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8549.json","vanir_signatures_modified":"2026-08-27T09:37:43Z","vanir_signatures":[{"target":{"file":"src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java","function":"update"},"deprecated":false,"digest":{"function_hash":"270229613550999132967406995517393388886","length":330},"id":"CVE-2025-8549-612704ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f"},{"target":{"file":"src/main/java/co/yiiu/pybbs/util/StringUtil.java"},"deprecated":false,"digest":{"line_hashes":["115268650506759166035324370279151498729","280176406971898854968825606527830241158","182525297906075285147171252277924818562","117009447928391832013214317892034792109"],"threshold":0.9},"id":"CVE-2025-8549-6973eff5","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f"},{"deprecated":false,"digest":{"line_hashes":["44988163048546600552815903415853877467","202735734141800528999299252104077551036","247319308767149502652351842060477247500","250138969961119757247502993840807545373"],"threshold":0.9},"id":"CVE-2025-8549-9c4833d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"}},{"id":"CVE-2025-8549-a030cb4c","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f","target":{"file":"src/test/java/co/yiiu/pybbs/util/StringUtilTest.java"},"deprecated":false,"digest":{"line_hashes":["173185835219587429818266525420990280721","23344658355463944789207840851219356319","39967944464928233130258257382202243407","89349373171966625277839266897415728954","29885505114640753428562351470623393438"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"197172528785238512935625033877331100437","length":76},"id":"CVE-2025-8549-ad97d6f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f","target":{"file":"src/test/java/co/yiiu/pybbs/util/StringUtilTest.java","function":"test"}},{"deprecated":false,"digest":{"function_hash":"194390188006079259632643148946308824661","length":1423},"id":"CVE-2025-8549-b2461955","signature_type":"Function","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f","target":{"file":"src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java","function":"register"}},{"id":"CVE-2025-8549-c8d641b7","signature_type":"Line","signature_version":"v1","source":"https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e5151282926ada54080244d499f","target":{"file":"src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java"},"deprecated":false,"digest":{"line_hashes":["257580239534913861751761633339963998749","99833859283486706441681745136795267575","3553701226829216480896977925102058170","338205797936644374852381495656945167082"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}