CVE-2026-92383
MediumCVSS 4.3Summary
A CSRF vulnerability in PbootCMS up to 3.2.24 affects the UserController::del and UserController::mod functions in the User Management component. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 3.2.25 resolves the issue.
Risk Assessment
The risk involves the possibility of performing unauthorized operations on the administrator account, such as deleting or modifying users, which could lead to full system compromise.
Recommendation
Immediately upgrade PbootCMS to version 3.2.25 or later, and implement additional CSRF protections such as tokens for sensitive operations.
Other vulnerabilities in PbootCMS
See all- CVE-2026-67960Critical
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components.
- CVE-2023-39834Critical
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.
- CVE-2026-92381Low
A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-79387Medium
SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.
- CVE-2026-36239Medium
PbootCMS version 3.2.11 contains a code injection vulnerability in its site configuration functionality.
- CVE-2020-20363Medium
A Cross-Site Scripting (XSS) vulnerability was found in PbootCMS version 2.0.3 in the admin.php file. It allows an attacker to inject malicious JavaScript code into the admin panel.
Original NVD description (English source)
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS