CVE-2026-92381 PUBLISHED

PbootCMS Template Rendering ContentController.php decode_string cross site scripting

Assigner: VulDB
Reserved: 16.09.2026 Published: 16.09.2026 Updated: 16.09.2026

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed".

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.1

Product Status

Vendor n/a
Product PbootCMS
Versions
  • Version 3.2.0 is affected
  • Version 3.2.1 is affected
  • Version 3.2.2 is affected
  • Version 3.2.3 is affected
  • Version 3.2.4 is affected
  • Version 3.2.5 is affected
  • Version 3.2.6 is affected
  • Version 3.2.7 is affected
  • Version 3.2.8 is affected
  • Version 3.2.9 is affected
  • Version 3.2.10 is affected
  • Version 3.2.11 is affected
  • Version 3.2.12 is affected
  • Version 3.2.13 is affected
  • Version 3.2.14 is affected
  • Version 3.2.15 is affected
  • Version 3.2.16 is affected
  • Version 3.2.17 is affected
  • Version 3.2.18 is affected
  • Version 3.2.19 is affected
  • Version 3.2.20 is affected
  • Version 3.2.21 is affected
  • Version 3.2.22 is affected

Credits

  • rockmelodeis (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Cross Site Scripting CWE
  • Code Injection CWE