Back to Database
Status published
Medium
CVE-2025-12297
atjiu pybbs UserApiController.java information disclosure
Vulnerability Description
A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12297
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- huangweigang (VulDB User)
References
More from atjiu
View All →CVE-2025-8814
atjiu pybbs CookieUtil.java setCookie cross-site request forgery
Medium
5.3
CVE-2025-8813
atjiu pybbs IndexController.java changeLanguage redirect
Medium
5.1
CVE-2025-8812
atjiu pybbs Admin Panel settings cross site scripting
Medium
4.8
CVE-2025-8555
atjiu pybbs search cross site scripting
Medium
5.1
CVE-2025-8554
atjiu pybbs list cross site scripting
Medium
4.8
Affected Vendor
atjiu
View all reports →Affected Software
pybbs
Vulnerable Versions:
6.0
Timeline
Official Publish:
October 27th, 2025
Last Modified:
October 27th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
MITRE ATT&CK TTPs
T1213
Data from Information Repositories
Collection
T1005
Data from Local System
Collection
T1552
Unsecured Credentials
Credential Access
T1041
Exfiltration Over C2 Channel
Exfiltration
T1190
Exploit Public-Facing Application
Initial Access
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1078
Valid Accounts
Persistence
T1565.002
Stored Data Manipulation
Impact