CVE-2025-8546: atjiu pybbs Verification Code login Captcha

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-05 · updated 2026-06-17
Weakness: CWE-287

Description

A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. It is recommended to apply a patch to fix this issue.

Affected products

atjiu pybbs: through 6.0.0

References

https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf
https://github.com/atjiu/pybbs/issues/199
https://github.com/atjiu/pybbs/issues/199#issue-3256276118
https://github.com/atjiu/pybbs/issues/199#issuecomment-3134573731
https://vuldb.com/?ctiid.318675
https://vuldb.com/?id.318675
https://vuldb.com/?submit.622179

Get alerted when CVE-2025-8546 or the next vulnerability affects your stack