{"id":"CVE-2026-79387","aliases":["EUVD-2026-75157","GHSA-h4hf-qj4h-x9j7"],"status":"published","title":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user...","description":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00291,"percentile":0.21962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2026-09-09T00:00:00Z","modified":"2026-09-14T15:33:27Z","exploits":[{"source":"pocgithub","id":"jhli07/CVE-2026-79387-PbootCMS-SQL-Injection","title":"jhli07/CVE-2026-79387-PbootCMS-SQL-Injection","date":"2026-09-09","url":"https://github.com/jhli07/CVE-2026-79387-PbootCMS-SQL-Injection"}],"references":[{"url":"https://www.pbootcms.com/"},{"url":"https://github.com/jhli07/CVE-2026-79387-PbootCMS-SQL-Injection"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79387"},{"url":"https://www.pbootcms.com"},{"url":"https://github.com/advisories/GHSA-h4hf-qj4h-x9j7"}],"sources":{"cve":[{"id":"CVE-2026-79387","description":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-14T14:38:59.282Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-75157","description":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-09-14T14:38:59Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:20.426868Z"}],"ghsa":[{"id":"GHSA-h4hf-qj4h-x9j7","title":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user...","description":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.","status":"published","published":"2026-09-09T21:31:57Z","modified":"2026-09-14T15:33:27Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:11:50.762382Z"}],"nvd":[{"id":"CVE-2026-79387","description":"SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.","status":"published","published":"2026-09-09T21:17:04.03Z","modified":"2026-09-14T15:17:07.78Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:45.93749Z"}]}}