PT-2026-26883 · Pbootcms · Pbootcms

Zmjjkk · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-4510

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.12

Description A weakness exists in PbootCMS that allows for cross site scripting. This issue impacts the alert location function within the apps/home/controller/MemberController.php file, specifically related to the Parameter Handler component. Manipulation of the backurl argument can lead to exploitation. The exploit has been publicly released, potentially enabling attacks.

Recommendations Update PbootCMS to a version newer than 3.2.12. As a temporary workaround, consider restricting access to the alert location function within the apps/home/controller/MemberController.php file until a patch is available.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2026-4510

Produtos afetados

Pbootcms

Referências · 7

• 🔥 https://github.com/zzj-create/cvetest/blob/main/VULN-05_BACKURL_OPEN_REDIRECT_XSS_REPORT_EN.md · Exploit
• https://vuldb.com/?id.352076 · Nota
• https://vuldb.com/?ctiid.352076 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4510 · Nota de Segurança
• https://vuldb.com/?submit.773904 · Nota
• https://twitter.com/CVEnew/status/2035262081117639007 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2035274686276255998 · Publicação no Twitter