Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Mar 20, 2026A security flaw has been discovered in atjiu pybbs 6.0.0.CVE-2026-4495 · Other software · atjiu · reported by VulDBLow 2
A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfx4tqqfvdw4.feishu.cnvuldb.com
Mar 20, 2026A vulnerability was identified in atjiu pybbs 6.0.0.CVE-2026-4494 · Other software · atjiu · reported by VulDBLow 2
A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfx4tqqfvdw4.feishu.cnvuldb.com
Oct 27, 2025A vulnerability was detected in atjiu pybbs up to 6.0.0.CVE-2025-12297 · Other software · atjiu · reported by VulDBLow 2.1
A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8814 · Other software · atjiu · reported by VulDBLow 2.1
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8813 · Other software · atjiu · reported by VulDBLow 2
A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8812 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8555 · Other software · atjiu · reported by VulDBLow 2
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the argument keyword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0.CVE-2025-8554 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/user/list. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0.CVE-2025-8553 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list. The manipulation of the argument word leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0.CVE-2025-8552 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0.CVE-2025-8551 · Other software · atjiu · reported by VulDBLow 2
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/comment/list. The manipulation of the argument Username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0.CVE-2025-8550 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/topic/list. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0.CVE-2025-8549 · Other software · atjiu · reported by VulDBLow 2.9
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e5151282926ada54080244d499f. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8548 · Other software · atjiu · reported by VulDBLow 2.9
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical.CVE-2025-8547 · Other software · atjiu · reported by VulDBMedium 5.5
A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 044f22893bee254dc2bb0d30f614913fab3c22c2. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8546 · Other software · atjiu · reported by VulDBMedium 5.5
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the SearcCVE-2022-23391 · Other software · Pybbs Project · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Search box.
- Product
- Pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2021A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.CVE-2020-28702 · Other software · Pybbs Project · reported by MITREHigh 7.5
A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.
- Product
- Pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.