CVE-2025-8555
BaseFortify
Publication date: 2025-08-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pybbs_project | pybbs | to 6.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8555 is a reflected cross-site scripting (XSS) vulnerability in the atjiu pybbs software up to version 6.0.0. It occurs in the /search endpoint where the 'keyword' parameter is not properly sanitized or encoded before being reflected in the webpage. This allows an attacker to inject malicious scripts that execute in the browsers of users who visit a crafted URL, potentially compromising their data or sessions. The vulnerability can be exploited remotely but requires user interaction. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts in the context of other users' browsers, including administrators. This can lead to session hijacking, unauthorized actions performed on behalf of users, or theft of sensitive information. Since the attack can be launched remotely via a crafted URL, it poses a risk to the integrity and security of the affected system and its users. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /search endpoint of the atjiu pybbs application for reflected cross-site scripting (XSS) via the 'keyword' parameter. A common detection method is to send a crafted HTTP request with a payload that includes a script or an event handler to see if it is reflected and executed. For example, you can use curl or a browser to test the following URL: http://<target>/search?keyword=%22%3E%3Cimg+src%3D1+onerror%3Dalert%28%27search-XSS%27%29%3E. If an alert box or script execution occurs, the vulnerability is present. Using tools like curl: curl -i "http://<target>/search?keyword=\"><img src=1 onerror=alert('search-XSS')>" or using automated scanners that detect reflected XSS can help identify this issue. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to apply the available patch identified by commit 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22, which fixes the improper handling of the 'keyword' parameter in the /search endpoint. Additionally, it is recommended to sanitize and properly encode user inputs to prevent script injection. Until the patch is applied, restrict access to the vulnerable endpoint if possible, and educate users to avoid clicking on suspicious links. Monitoring for exploitation attempts and updating the software promptly are also advised. [1]