Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the…
Priority LOW 30CWE-668Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-668 and the CVSS impact.
Summary
Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.
Why it matters now
EPSS 0.00796 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-22535
- 2026-10-03 Alias added: GHSA-89cg-xf2g-7r8m
References
More Pbootcms vulnerabilities
- TI-2023-20796 PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function. CVSS 3.1CRITICAL 9.8
- TI-2021-15409 SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run… CVSS 3.1CRITICAL 9.8
- TI-2025-28937 SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to… CVSS 3.1HIGH 8.8
- TI-2025-13832 PbootCMS Header handle.php get_user_ip less trusted source CVSS 4.0MEDIUM 6.9
- TI-2022-14094 PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
- TI-2023-27380 Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote… CVSS 3.1HIGH 7.5
Sources
- CVE-2020-22535 · CVE Program
- CVE-2020-22535 · NVD
- FIRST EPSS
- GHSA-89cg-xf2g-7r8m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences