PT-2026-48866 · Pbootcms · Pbootcms

Yunyan05 · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-12066

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.13

Description A security flaw in the Password Handler component allows for weak password recovery. The issue exists in the retrieve() function within the apps/home/controller/MemberController.php file. Remote attackers can exploit this by manipulating the username, password, email, or checkcode arguments.

Recommendations Update to a version later than 3.2.12. As a temporary workaround, restrict access to the retrieve() function in the apps/home/controller/MemberController.php file.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-12066

Affected Products

Pbootcms

References · 8

• 🔥 https://github.com/yunyan05/MYCVE/tree/main/PbootCMS/V3.2.12-Account-Takeover · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12066 · Security Note
• https://github.com/pbootcmspro/PbootCMS/issues/38 · Note
• https://twitter.com/CVEnew/status/2065461497698877598 · Twitter Post
• https://vuldb.com/vuln/370561 · Note
• https://vuldb.com/vuln/370561/cti · Note
• https://vuldb.com/cve/CVE-2026-12066 · Note
• https://vuldb.com/submit/828374 · Note