Which versions of Java are affected by CVE-2025-8548?

Organizations using atjiu pybbs should be aware of moderate risk from CVE-2025-8548, a information exposure vulnerability rated CVSS 6.3.. A patch is available.

Is there a public PoC exploit available for CVE-2025-8548?

Yes, a public proof-of-concept exploit is available for CVE-2025-8548. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-8548?

Within 30 days: Identify affected systems running atjiu pybbs and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Java CVE-2025-8548

Q: What is the CVSS score of CVE-2025-8548?

CVE-2025-8548 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Information Exposure (CWE-200)

2025-08-05 cna@vuldb.com

Java Information Disclosure Pybbs Pybbs Project

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.9 (LOW)

Analysis Generated

Mar 28, 2026 - 19:05 vuln.today

Patch released

Mar 28, 2026 - 19:05 nvd

Patch available

PoC Detected

Sep 03, 2025 - 13:28 vuln.today

Public exploit code

CVE Published

Aug 05, 2025 - 07:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue.

AnalysisAI

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.java of the component Registered Email Handler. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue. Affected products include: Pybbs Project Pybbs. Version information: up to 6.0.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.