Which versions of diyhi bbs are affected by CVE-2025-6762?

Organizations using diyhi bbs should be aware of moderate risk from CVE-2025-6762, a server-side request forgery vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2025-6762?

Yes, a public proof-of-concept exploit is available for CVE-2025-6762. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6762?

Within 30 days: Identify affected systems running diyhi bbs and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

diyhi bbs CVE-2025-6762

Q: What is the CVSS score of CVE-2025-6762?

CVE-2025-6762 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19325 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2025-06-27 cna@vuldb.com

SSRF Bbs Diyhi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Requires low-privilege access to admin panel; SSRF impact limited to partial confidentiality, integrity, availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19325

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

PoC Detected

Sep 02, 2025 - 18:09 vuln.today

Public exploit code

CVE Published

Jun 27, 2025 - 12:15 cve.org

LOW 2.1

CVE Published

Jun 27, 2025 - 12:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Server-side request forgery in diyhi bbs up to version 6.8 allows remote authenticated attackers with low privileges to manipulate the Host header via the /admin/login endpoint, enabling limited unauthorized access to internal resources. A public proof-of-concept exploit is available, but no active exploitation has been confirmed; EPSS score indicates a low probability of exploitation (0.08%).

Technical ContextAI

The vulnerability resides in the getUrl function within the /admin/login HTTP Header Handler of diyhi bbs. This server-side request forgery (CWE-918) arises from insufficient validation of the Host header. The affected product, identified by CPE cpe:2.3:a:diyhi:bbs:*:*:*:*:*:*:*:*, is a bulletin board system. Attackers can abuse the Host header to force the server to make unauthorized requests to internal or external services, potentially bypassing network restrictions.

RemediationAI

No vendor-released patch has been identified at the time of analysis. As a short-term mitigation, restrict access to the /admin endpoint to trusted IP addresses using network controls or application-level access rules. Deploy a web application firewall (WAF) to filter malicious Host header values. Disabling the affected feature may not be possible without source code changes. Note: IP restriction could hinder legitimate remote administration; consider using a VPN or SSL-based access.