CVE-2025-15153
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A weakness was identified in PbootCMS up to version 3.2.12 in the file /data/pbootcms.db of the SQLite Database component. Manipulation leads to files or directories accessible. The attack can be launched remotely but is difficult to exploit.
Risk Assessment
The vulnerability may allow unauthorized access to files or directories, potentially leading to data disclosure or further attacks. Remote attack is possible but requires high complexity.
Recommendation
It is recommended to modify configuration settings to restrict access to the database. Also consider updating PbootCMS to a newer version if available.
Other vulnerabilities in PbootCMS
See all- CVE-2026-92383Medium
A CSRF vulnerability in PbootCMS up to 3.2.24 affects the UserController::del and UserController::mod functions in the User Management component. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 3.2.25 resolves the issue.
- CVE-2026-67960Critical
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components.
- CVE-2023-39834Critical
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.
- CVE-2026-92381Low
A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-79387Medium
SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.
- CVE-2026-36239Medium
PbootCMS version 3.2.11 contains a code injection vulnerability in its site configuration functionality.
- CVE-2025-15154Medium
Vulnerability in PbootCMS up to 3.2.12 affects the get_user_ip function in core/function/handle.php. Manipulation of the X-Forwarded-For argument leads to use of less trusted source.
- CVE-2020-20363Medium
A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.
Original NVD description (English source)
A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. Modifying the configuration settings is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS