Mr艾伯德梅斯特朗

**Name of the Vulnerable Software and Affected Versions** LinZhaoguan pb-cms version 2.0 **Description** A vulnerability was found in the Classification Management Page component, where the manipulation of the `Classification name` argument leads to cross-site scripting. The attack can be launched remotely. **Recommendations** For LinZhaoguan pb-cms version 2.0, as a temporary workaround, consider restricting access to the Classification Management Page until a patch is available. Avoid using the `Classification name` argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LinZhaoguan pb-cms version 2.0 **Description** A problem was found in the Friendship Link Handler component, specifically in some unknown functionality of the file /admin#links. This issue leads to cross-site scripting and can be exploited remotely. **Recommendations** For version 2.0, consider restricting access to the /admin#links file until a fix is available. As a temporary workaround, avoid using the Friendship Link Handler component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LinZhaoguan pb-cms version 2.0 **Description** The issue allows a remote attacker to execute arbitrary code via the theme management function. This is a result of a Cross Site Scripting vulnerability. **Recommendations** For LinZhaoguan pb-cms version 2.0, consider disabling the theme management function until a patch is available. Restrict access to the theme management module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.