PT-2026-3423 · Bootdo · Bootdo

Tom132432 · Publicado 2026-01-19 · Atualizado 2026-01-19 · CVE-2026-1136

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions lcg0124 BootDo versions prior to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb

Description A weakness exists in lcg0124 BootDo. The Save function within the /blog/bContent/save file of the ContentController component is susceptible to cross site scripting. Manipulation of the content, author, and title arguments can trigger this issue. Remote exploitation is possible, and the exploit has been publicly released.

Recommendations Versions prior to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb should be updated. As a temporary workaround, consider restricting access to the /blog/bContent/save file. Avoid using the content, author, and title parameters in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2026-1136

Produtos afetados

Bootdo

Referências · 6

• 🔥 https://github.com/webzzaa/CVE-/issues/4 · Exploit
• https://vuldb.com/?submit.735164 · Nota
• https://vuldb.com/?ctiid.341726 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1136 · Nota de Segurança
• https://vuldb.com/?id.341726 · Nota
• https://twitter.com/CVEnew/status/2013119522299908363 · Publicação no Twitter