CVE-2026-4508

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4508", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-20T14:25:45.837Z", "datePublished": "2026-03-20T22:32:10.375Z", "dateUpdated": "2026-03-24T15:38:50.856Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-20T22:32:10.375Z"}, "title": "PbootCMS Member Login MemberController.php checkUsername sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "n/a", "product": "PbootCMS", "versions": [{"version": "3.2.0", "status": "affected"}, {"version": "3.2.1", "status": "affected"}, {"version": "3.2.2", "status": "affected"}, {"version": "3.2.3", "status": "affected"}, {"version": "3.2.4", "status": "affected"}, {"version": "3.2.5", "status": "affected"}, {"version": "3.2.6", "status": "affected"}, {"version": "3.2.7", "status": "affected"}, {"version": "3.2.8", "status": "affected"}, {"version": "3.2.9", "status": "affected"}, {"version": "3.2.10", "status": "affected"}, {"version": "3.2.11", "status": "affected"}, {"version": "3.2.12", "status": "affected"}], "cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "modules": ["Member Login"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-20T15:31:02.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "zmjjkk (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.352074", "name": "VDB-352074 | PbootCMS Member Login MemberController.php checkUsername sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.352074", "name": "VDB-352074 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.773900", "name": "Submit #773900 | \u7ff1\u4e91\u79d1\u6280 PbootCMS 3.2.12 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T15:37:38.857038Z", "id": "CVE-2026-4508", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:38:50.856Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4508", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T15:37:38.857038Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:38:10.225Z"}}], "cna": {"title": "PbootCMS Member Login MemberController.php checkUsername sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "zmjjkk (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Member Login"], "product": "PbootCMS", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.2.9"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.11"}, {"status": "affected", "version": "3.2.12"}]}], "timeline": [{"lang": "en", "time": "2026-03-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-20T15:31:02.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.352074", "name": "VDB-352074 | PbootCMS Member Login MemberController.php checkUsername sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.352074", "name": "VDB-352074 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.773900", "name": "Submit #773900 | \u7ff1\u4e91\u79d1\u6280 PbootCMS 3.2.12 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-20T22:32:10.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4508", "state": "PUBLISHED", "dateUpdated": "2026-03-24T15:38:50.856Z", "dateReserved": "2026-03-20T14:25:45.837Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-20T22:32:10.375Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "modules": ["Member Login"], "product": "PbootCMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.2.9"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.11"}, {"status": "affected", "version": "3.2.12"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en PbootCMS hasta 3.2.12. El elemento afectado es la funci\u00f3n checkUsername del archivo apps/home/controller/MemberController.php del componente Member Login. La manipulaci\u00f3n del argumento Username conduce a inyecci\u00f3n SQL. El ataque puede ser iniciado remotamente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado."}], "id": "CVE-2026-4508", "lastModified": "2026-06-17T10:56:43.560", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4508", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T15:37:38.857038Z", "version": "2.0.3"}}]}, "published": "2026-03-20T23:16:48.493", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.352074"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.352074"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.773900"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.12"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PbootCMS", "source": "cna", "vendor": "n/a"}, "product": "pbootcms", "vendor": "pbootcms"}], "analysis": {"en": {"generated_at": "2026-03-20T23:22:53.163529+00:00", "value": {"mitigation_remediation": ["Check the PbootCMS website or repository for a patch that removes the SQL injection in checkUsername and apply the updated version (e.g., 3.2.13 or later).", "If a patch is not yet available, isolate the affected system from external network traffic or place the login endpoint behind a web application firewall configured to block SQL injection patterns."], "summary": {"action": "Immediate Patch", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "PbootCMS versions up to 3.2.12 are affected. The vulnerability occurs in the Member Login component of the applications located in apps/home/controller/MemberController.php.", "description_and_impact": "The vulnerability resides in the checkUsername function of PbootCMS\u2019s MemberController, allowing an attacker to manipulate the Username parameter and inject arbitrary SQL. This flaw enables a remote attacker to bypass authentication, read, modify, or delete database records, and potentially gain full control over application data. The weakness is a classic SQL Injection, identified by CWE-74 and CWE-89, which directly compromises confidentiality and integrity of the database.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a medium severity. The exploit is publicly available, meaning it can be accessed over the network without specialized infrastructure. EPSS data is not provided, and the vulnerability is not listed in CISA\u2019s KEV catalog, but the remote nature and public availability increase the practical risk. The attacker would need only a crafted request to the login endpoint to exploit the flaw."}}}}, "created": "2026-03-23T09:52:26.111430+00:00", "updated": "2026-03-25T14:34:19.343267+00:00", "vendors": ["pbootcms", "pbootcms$PRODUCT$pbootcms"]}