CVE-2018-10132

HIGH

PbootCMS v0.9.8 - Cross-Site Request Forgery via Message Modification Endpoint

Title source: llm
STIX 2.1

Description

PbootCMS v0.9.8 has CSRF via an admin.php/Message/mod/id/19.html?backurl=/index.php request, resulting in PHP code injection in the recontent parameter.

References (1)

Core 1

Scores

CVSS v3 8.8
EPSS 0.0052
EPSS Percentile 40.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
pbootcms/pbootcms 0.9.8
Published Apr 16, 2018
Tracked Since Feb 18, 2026