{"id":"CVE-2025-12297","state":"PUBLISHED","title":"atjiu pybbs UserApiController.java information disclosure","description":"A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.","publishedAt":"2025-10-27T16:32:14.311Z","updatedAt":"2025-10-27T17:26:20.100Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["atjiu pybbs"],"affected":[{"vendor":"atjiu","product":"pybbs","versions":[{"version":"6.0","status":"affected"}]}],"references":["https://vuldb.com/?id.329965","https://vuldb.com/?ctiid.329965","https://vuldb.com/?submit.675906","https://www.yuque.com/yuqueyonghutxhnup/pbbo84/ruh1cg5isrmugkh3?singleDoc"],"weaknesses":["CWE-200","CWE-284"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/12xxx/CVE-2025-12297.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-12297","state":"PUBLISHED","datePublished":"2025-10-27T16:32:14.311Z","dateUpdated":"2025-10-27T17:26:20.100Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-10-26T16:51:50.650Z"},"containers":{"cna":{"title":"atjiu pybbs UserApiController.java information disclosure","descriptions":[{"lang":"en","value":"A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used."},{"lang":"de","value":"Es wurde eine Schwachstelle in atjiu pybbs up to 6.0.0 entdeckt. Betroffen ist eine unbekannte Verarbeitung der Datei UserApiController.java. Die Bearbeitung verursacht information disclosure. Es ist möglich, den Angriff aus der Ferne durchzuführen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"atjiu","product":"pybbs","versions":[{"version":"6.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.329965","name":"VDB-329965 | atjiu pybbs UserApiController.java information disclosure","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.329965","name":"VDB-329965 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.675906","name":"Submit #675906 | pybbs <=6.0.0 Improper Control of Resource Identifiers","tags":["third-party-advisory"]},{"url":"https://www.yuque.com/yuqueyonghutxhnup/pbbo84/ruh1cg5isrmugkh3?singleDoc","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"Information Disclosure"}]},{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-10-27T16:32:14.311Z"},"timeline":[{"time":"2025-10-26T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-10-26T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-10-26T17:56:54.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"huangweigang (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-27T17:25:46.140407Z","id":"CVE-2025-12297","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-27T17:26:20.100Z"}}]}}}