CVE-2026-67960

Deferred Deferred - Pending Action

Remote Code Execution in PbootCMS

Publication date: 2026-08-17

Last updated on: 2026-08-31

Assigner: MITRE

Description

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-31

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-05

NVD

CVE-2026-67960

EUVD

EUVD-2026-60551

Affected Vendors & Products

Vendor	Product	Version / Range
pbootcms	pbootcms	3.2.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in PbootCMS v3.2.15 allows an attacker to execute arbitrary code through multiple components including MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php. This is likely due to insufficient input validation or improper handling of user-controlled data in these components.

Detection Guidance

This vulnerability involves arbitrary code execution in PbootCMS v3.2.15 through specific components like MemberController.php and UserController.php. Detection requires checking for unauthorized code execution attempts or suspicious activity in these files. Review server logs for unusual requests targeting these components, especially those with unexpected parameters or payloads.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on the server hosting PbootCMS. This may lead to unauthorized access, data theft, defacement of the website, or further compromise of the server and connected systems.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR, HIPAA, or other regulations requiring protection of personal or health data. Non-compliance risks include legal penalties, fines, and reputational damage due to unauthorized access to sensitive information.

Mitigation Strategies

Immediately update PbootCMS to the latest version to address the arbitrary code execution vulnerability in MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components.

Hi! I’m here to help you understand CVE-2026-67960. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70