CVE-2026-4508

PbootCMS Member Login MemberController.php checkUsername sql injection

CVSS 6.9 MEDIUMEPSS 0.3%CWE-74 CWE-89

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.9EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

20 mar 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

n/a · PbootCMS

Referencias

https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md https://vuldb.com/?ctiid.352074 https://vuldb.com/?id.352074 https://vuldb.com/?submit.773900