Vulnerabilities

TI-2025-13832 CVE-2025-15154 · GHSA-hgch-f8pj-55cf

PbootCMS Header handle.php get_user_ip less trusted source

HIGH 70

A security vulnerability has been detected in PbootCMS up to 3.2.12.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0025 Published 2025-12-28 No fix listed CWE-348

TI-2025-13831 CVE-2025-15153 · GHSA-vj9r-pqp4-6mxr

PbootCMS SQLite Database pbootcms.db file access

MEDIUM 61

A weakness has been identified in PbootCMS up to 3.2.12.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00509 Published 2025-12-28 No fix listed CWE-425

TI-2025-28937 CVE-2025-46109 · GHSA-hxqf-qrp4-9h3r

SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to…

HIGH 73

SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET request

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00423 Published 2025-06-18 No fix listed CWE-89

TI-2025-03337 CVE-2025-3787 · GHSA-hmfp-mwgf-vxwx

PbootCMS Image server-side request forgery

MEDIUM 56

A vulnerability was found in PbootCMS 3.2.5.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00474 Published 2025-04-18 No fix listed CWE-918

TI-2025-21062 CVE-2025-29389 · GHSA-j2cv-mq44-5cqr

PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.

MEDIUM 60

PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00264 Published 2025-04-09 No fix listed CWE-79

TI-2020-13567 CVE-2020-19248 · GHSA-472m-7rg9-p78j

SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates…

MEDIUM 58

SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by searching for page contamination URLs, thus triggering vulne…

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00261 Published 2025-02-21 No fix listed CWE-89

TI-2024-11856 CVE-2024-12793 · GHSA-494w-gq5c-m2qq

PbootCMS IndexController.php path traversal

LOW 25

A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00504 Published 2024-12-19 No fix listed CWE-22

TI-2024-11852 CVE-2024-12789 · GHSA-57cm-p9q8-qfqp

PbootCMS IndexController.php code injection

MEDIUM 57

A vulnerability was found in PbootCMS up to 3.2.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00556 Published 2024-12-19 No fix listed CWE-74

TI-2024-28675 CVE-2024-42930 · GHSA-m6r2-8whm-hxrj

PbootCMS 3.2.8 is vulnerable to URL Redirect.

LOW 27

PbootCMS 3.2.8 is vulnerable to URL Redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00276 Published 2024-10-28 No fix listed CWE-601

TI-2024-00941 CVE-2024-1018 · GHSA-6m95-c675-56r5

PbootCMS cross site scripting

LOW 28

A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00505 Published 2024-01-29 No fix listed CWE-79

TI-2023-27380 CVE-2023-50082 · GHSA-5cpg-h4r2-65fc

Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote…

HIGH 66

Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00606 Published 2024-01-04 No fix listed

TI-2023-20796 CVE-2023-39834 · GHSA-gw39-99gr-hwx5

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.

HIGH 82

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02102 Published 2023-08-24 No fix listed CWE-77

TI-2021-15409 CVE-2021-37497 · GHSA-g7w8-g554-fvr3

SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run…

HIGH 82

SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01247 Published 2023-02-03 No fix listed CWE-89

TI-2022-14094 CVE-2022-32417 · GHSA-cf3r-m6x2-g3r5

PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via…

HIGH 68

PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.35243 Published 2022-07-14 No fix listed CWE-94

TI-2020-13955 CVE-2020-20971 · GHSA-p3cg-g5xh-2343

Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.

LOW 39

Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00543 Published 2022-06-01 No fix listed CWE-352

TI-2020-13398 CVE-2020-18456 · GHSA-5vqr-mj69-g96r

Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title…

LOW 23

Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00527 Published 2021-08-12 No fix listed CWE-79

TI-2020-14348 CVE-2020-22535 · GHSA-89cg-xf2g-7r8m

Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the…

LOW 30

Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00796 Published 2021-07-09 No fix listed CWE-668

TI-2020-14603 CVE-2020-23580 · GHSA-v94q-jqmm-4m2r

Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.

MEDIUM 47

Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02474 Published 2021-07-08 No fix listed

TI-2020-13837 CVE-2020-20363 · GHSA-wx74-j5rp-9c5g

Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php.

LOW 23

Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0057 Published 2021-07-08 No fix listed CWE-79

TI-2020-13964 CVE-2020-21003 · GHSA-9c2r-jv32-cj3f

Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.

LOW 23

Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00482 Published 2021-06-03 No fix listed CWE-79

TI-2021-09448 CVE-2021-28245 · GHSA-wf52-pmf8-w9j3

PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search…

LOW 35

PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01177 Published 2021-03-31 No fix listed CWE-89

TI-2020-13293 CVE-2020-17901 · GHSA-54fr-cp53-9gm6

Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.

LOW 29

Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00439 Published 2020-11-30 No fix listed CWE-352

TI-2018-11719 CVE-2018-16357 · GHSA-xv6g-g79p-x344

An issue was discovered in PbootCMS.

MEDIUM 46

An issue was discovered in PbootCMS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01838 Published 2020-03-02 No fix listed CWE-89

TI-2018-11718 CVE-2018-16356 · GHSA-mv53-3jm2-g7cq

An issue was discovered in PbootCMS.

MEDIUM 46

An issue was discovered in PbootCMS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01838 Published 2020-03-02 No fix listed CWE-89

TI-2019-13006 CVE-2019-17417 · GHSA-c7gq-hrwc-gfcq

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.

LOW 23

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00646 Published 2019-10-09 No fix listed CWE-79

Vulnerabilities

Filters