5.1
Medium
CVE-2026-92381 A weakness has been identified in PbootCMS up to 3.2.22
Description
A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed".
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PbootCMS 3.2 | 3.2.0 → 3.2.22 | No fix stated |
References
- VDB-405518 | PbootCMS Template Rendering ContentController.php decode_string cross site scripting vuldb.com
- VDB-405518 | CTI Indicators (IOB, IOC, TTP, IOA) vuldb.com
- CVE-2026-92381 | CVE Analysis and Report vuldb.com
- Submit #938556 | pbootcmspro PbootCMS <=V3.2.22 Incomplete Denylist to Cross-Site Scripting vuldb.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of PbootCMS
The 13 CVEs of PbootCMS →
CVE-2026-92383
A security vulnerability has been detected in PbootCMS up to 3.2.24
5.3
Medium
CVE-2026-12066
A security flaw has been discovered in PbootCMS up to 3.2.12
6.9
Medium
CVE-2026-4514
A flaw has been found in PbootCMS up to 3.2.12
5.3
Medium
CVE-2026-4510
A weakness has been identified in PbootCMS up to 3.2.12
5.3
Medium