Pbootcms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-46109 SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET requestHigh 8.8 · Jun 18, 2025
• CVE-2023-50082 Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a uHigh 7.5 · Jan 4, 2024
• CVE-2023-39834 PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.Critical 9.8 · Aug 24, 2023
• CVE-2021-37497 SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.Critical 9.8 · Feb 3, 2023
• CVE-2022-32417 PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.Critical 9.8 · Jul 14, 2022
• CVE-2020-20971 Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.High 8.8 · Jun 2, 2022
• CVE-2020-23580 Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.Critical 9.8 · Jul 8, 2021
• CVE-2021-28245 PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin aHigh 7.5 · Mar 31, 2021
• CVE-2018-16357 An issue was discovered in PbootCMS.Critical 9.8 · Mar 2, 2020
• CVE-2018-16356 An issue was discovered in PbootCMS.Critical 9.8 · Mar 2, 2020
• CVE-2019-8422 A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php.High 7.2 · Feb 17, 2019
• CVE-2018-19893 SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.Critical 9.8 · Dec 5, 2018
• CVE-2018-19595 PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?cuCritical 9.8 · Nov 27, 2018
• CVE-2018-19053 PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a SHigh 7.2 · Nov 7, 2018
• CVE-2018-18450 apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.pCritical 9.8 · Oct 17, 2018
• CVE-2018-18211 PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.High 8.1 · Oct 10, 2018
• CVE-2018-11369 An issue was discovered in PbootCMS v1.0.9.Critical 9.8 · May 22, 2018
• CVE-2018-11018 An issue was discovered in PbootCMS v1.0.7.High 8.8 · May 13, 2018
• CVE-2018-10133 PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \appsCritical 9.8 · Apr 16, 2018
• CVE-2018-10132 PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter.High 8.8 · Apr 16, 2018