{"id":"CVE-2026-4508","state":"PUBLISHED","title":"PbootCMS Member Login MemberController.php checkUsername sql injection","description":"A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.","publishedAt":"2026-03-20T22:32:10.375Z","updatedAt":"2026-03-24T15:38:50.856Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["n/a PbootCMS"],"affected":[{"vendor":"n/a","product":"PbootCMS","versions":[{"version":"3.2.0","status":"affected"},{"version":"3.2.1","status":"affected"},{"version":"3.2.2","status":"affected"},{"version":"3.2.3","status":"affected"},{"version":"3.2.4","status":"affected"},{"version":"3.2.5","status":"affected"},{"version":"3.2.6","status":"affected"},{"version":"3.2.7","status":"affected"},{"version":"3.2.8","status":"affected"},{"version":"3.2.9","status":"affected"},{"version":"3.2.10","status":"affected"},{"version":"3.2.11","status":"affected"},{"version":"3.2.12","status":"affected"}],"cpes":["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"],"modules":["Member Login"]}],"references":["https://vuldb.com/?id.352074","https://vuldb.com/?ctiid.352074","https://vuldb.com/?submit.773900","https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4508.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4508","state":"PUBLISHED","datePublished":"2026-03-20T22:32:10.375Z","dateUpdated":"2026-03-24T15:38:50.856Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-20T14:25:45.837Z"},"containers":{"cna":{"title":"PbootCMS Member Login MemberController.php checkUsername sql injection","descriptions":[{"lang":"en","value":"A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used."}],"affected":[{"vendor":"n/a","product":"PbootCMS","versions":[{"version":"3.2.0","status":"affected"},{"version":"3.2.1","status":"affected"},{"version":"3.2.2","status":"affected"},{"version":"3.2.3","status":"affected"},{"version":"3.2.4","status":"affected"},{"version":"3.2.5","status":"affected"},{"version":"3.2.6","status":"affected"},{"version":"3.2.7","status":"affected"},{"version":"3.2.8","status":"affected"},{"version":"3.2.9","status":"affected"},{"version":"3.2.10","status":"affected"},{"version":"3.2.11","status":"affected"},{"version":"3.2.12","status":"affected"}],"cpes":["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"],"modules":["Member Login"]}],"references":[{"url":"https://vuldb.com/?id.352074","name":"VDB-352074 | PbootCMS Member Login MemberController.php checkUsername sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352074","name":"VDB-352074 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.773900","name":"Submit #773900 | 翱云科技 PbootCMS 3.2.12 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/zzj-create/cvetest/blob/main/VULN-01_MEMBER_LOGIN_SQLI_REPORT_EN.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-20T22:32:10.375Z"},"timeline":[{"time":"2026-03-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-20T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-20T15:31:02.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"zmjjkk (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-24T15:37:38.857038Z","id":"CVE-2026-4508","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-24T15:38:50.856Z"}}]}}}