Priority HIGH 82
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02102 · Published 2023-08-24 · No fix listed CWE-77
Priority HIGH 82
SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01247 · Published 2023-02-03 · No fix listed CWE-89
Priority HIGH 73
SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET request
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00423 · Published 2025-06-18 · No fix listed CWE-89
Priority HIGH 70
A security vulnerability has been detected in PbootCMS up to 3.2.12.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0025 · Published 2025-12-28 · No fix listed CWE-348
Priority HIGH 68
PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.35243 · Published 2022-07-14 · No fix listed CWE-94
Priority HIGH 66
Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00606 · Published 2024-01-04 · No fix listed
Priority MEDIUM 61
A weakness has been identified in PbootCMS up to 3.2.12.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00509 · Published 2025-12-28 · No fix listed CWE-425
Priority MEDIUM 60
PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00264 · Published 2025-04-09 · No fix listed CWE-79
Priority MEDIUM 58
SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by searching for page contamination URLs, thus triggering vulne…
CVSS 3.1MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.00261 · Published 2025-02-21 · No fix listed CWE-89
Priority MEDIUM 57
A vulnerability was found in PbootCMS up to 3.2.3.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00556 · Published 2024-12-19 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability was found in PbootCMS 3.2.5.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00474 · Published 2025-04-18 · No fix listed CWE-918
Priority MEDIUM 49
PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}&a=phpinfo(); UR…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03858 · Published 2018-11-27 · No fix listed CWE-94
Priority MEDIUM 47
Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02474 · Published 2021-07-08 · No fix listed
Priority MEDIUM 46
An issue was discovered in PbootCMS.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01838 · Published 2020-03-02 · No fix listed CWE-89
Priority MEDIUM 46
An issue was discovered in PbootCMS.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01838 · Published 2020-03-02 · No fix listed CWE-89
Priority MEDIUM 45
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0152 · Published 2018-10-17 · No fix listed CWE-89
Priority MEDIUM 45
PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01373 · Published 2018-04-16 · No fix listed CWE-94
Priority MEDIUM 44
SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01135 · Published 2018-12-06 · No fix listed CWE-89
Priority MEDIUM 44
An issue was discovered in PbootCMS v1.0.9.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01097 · Published 2018-05-22 · No fix listed CWE-89
Priority LOW 39
Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00543 · Published 2022-06-01 · No fix listed CWE-352
Priority LOW 39
An issue was discovered in PbootCMS v1.0.7.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00593 · Published 2018-05-13 · No fix listed CWE-352
Priority LOW 39
PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00505 · Published 2018-04-16 · No fix listed CWE-352
Priority LOW 37
PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.00883 · Published 2018-10-10 · No fix listed CWE-89
Priority LOW 35
PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01177 · Published 2021-03-31 · No fix listed CWE-89
Priority LOW 35
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a SELECT statement containing this PHP code.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01437 · Published 2018-11-07 · No fix listed CWE-94
Load more
THREATIST.IORead the docs