PT-2026-26887 · Pbootcms · Pbootcms

Zmjjkk · Published 2026-03-21 · Updated 2026-03-22 · CVE-2026-4514

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PbootCMS versions up to 3.2.12

Description A flaw exists in PbootCMS that may allow for improper access controls. This issue is related to functionality within the apps/admin/controller/system/UserController.php file of the Backend component. Exploitation involves manipulating the Field argument, and the attack can be performed remotely. The exploit has been published.

Recommendations Versions prior to 3.2.12 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2026-4514

Affected Products

Pbootcms

References · 8

• 🔥 https://github.com/zzj-create/cvetest/blob/main/VULN-06_BACKEND_ARBITRARY_FIELD_MODIFICATION_REPORT_EN.md#vuln-06-pbootcms-3212-backend-arbitrary-field-modification · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4514 · Security Note
• https://twitter.com/VulmonFeeds/status/2035320229459374157 · Twitter Post
• https://vuldb.com/?id.352079 · Note
• https://vuldb.com/?submit.773907 · Note
• https://vuldb.com/?ctiid.352079 · Note
• https://twitter.com/cyberbivash/status/2035338708677808242 · Twitter Post
• https://twitter.com/CVEnew/status/2035619772378009888 · Twitter Post