Pbootcms

pbootcms

36 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (36)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-28245 1Pbootcms 1Pbootcms Jun 17, 2026 Mar 31, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account.
CVE-2020-17901 1Pbootcms 1Pbootcms Jun 17, 2026 Nov 30, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.
CVE-2018-16357 1Pbootcms 1Pbootcms Nov 21, 2024 Mar 2, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.
CVE-2018-16356 1Pbootcms 1Pbootcms Nov 21, 2024 Mar 2, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.
CVE-2019-17417 1Pbootcms 1Pbootcms Jun 17, 2026 Oct 10, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.
CVE-2019-8422 1Pbootcms 1Pbootcms Jun 17, 2026 Feb 17, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php.
CVE-2019-7570 1Pbootcms 1Pbootcms Jun 17, 2026 Feb 7, 2019 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI.
CVE-2018-19893 1Pbootcms 1Pbootcms Nov 21, 2024 Dec 6, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.
CVE-2018-19595 1Pbootcms 1Pbootcms Nov 21, 2024 Nov 27, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}&a=phpinfo(); UR...Show more PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}&a=phpinfo(); URI, because of an incorrect apps\home\controller\ParserController.php parserIfLabel protection mechanism.Show less
CVE-2018-19053 1Pbootcms 1Pbootcms Nov 21, 2024 Nov 7, 2018 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a SELECT statement containing this PHP code.
CVE-2018-18450 1Pbootcms 1Pbootcms Nov 21, 2024 Oct 17, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI.
CVE-2018-18211 1Pbootcms 1Pbootcms Nov 21, 2024 Oct 10, 2018 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.
CVE-2018-11369 1Pbootcms 1Pbootcms Nov 21, 2024 May 22, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the \apps\home\controller\ParserController.php scode parameter.
CVE-2018-11018 1Pbootcms 1Pbootcms Nov 21, 2024 May 13, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add....Show more An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html.Show less
CVE-2018-10133 1Pbootcms 1Pbootcms Nov 21, 2024 Apr 16, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php.
CVE-2018-10132 1Pbootcms 1Pbootcms Nov 21, 2024 Apr 16, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter.