CVE-2026-92381CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2026-92381

Low · published September 16, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed".

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00348 · 27.2th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-16T19:19Z
References (6)
https://github.com/pbootcmspro/PbootCMS/issues/69 · [email protected]https://vuldb.com/cve/CVE-2026-92381 · [email protected]https://vuldb.com/submit/938556 · [email protected]https://vuldb.com/vuln/405518 · [email protected]https://vuldb.com/vuln/405518/cti · [email protected]https://github.com/pbootcmspro/PbootCMS · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 14:45Z
    PbootCMS Template Rendering ContentController.php decode_string cross site scripting
    cvelistv5