PT-2026-26887 · Pbootcms · Pbootcms

Zmjjkk · Publicado 2026-03-21 · Atualizado 2026-03-22 · CVE-2026-4514

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PbootCMS versions up to 3.2.12

Description A flaw exists in PbootCMS that may allow for improper access controls. This issue is related to functionality within the apps/admin/controller/system/UserController.php file of the Backend component. Exploitation involves manipulating the Field argument, and the attack can be performed remotely. The exploit has been published.

Recommendations Versions prior to 3.2.12 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Improper Access Control

Enumeração de Fraquezas

CWE-266

CWE-284

Identificadores relacionados

CVE-2026-4514

Produtos afetados

Pbootcms

Referências · 8

• 🔥 https://github.com/zzj-create/cvetest/blob/main/VULN-06_BACKEND_ARBITRARY_FIELD_MODIFICATION_REPORT_EN.md#vuln-06-pbootcms-3212-backend-arbitrary-field-modification · Exploit
• https://twitter.com/VulmonFeeds/status/2035320229459374157 · Publicação no Twitter
• https://vuldb.com/?id.352079 · Nota
• https://vuldb.com/?submit.773907 · Nota
• https://vuldb.com/?ctiid.352079 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4514 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2035338708677808242 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035619772378009888 · Publicação no Twitter