What is the CVSS score of CVE-2026-36239?

CVE-2026-36239 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PbootCMS CVE-2026-36239

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-26 mitre

XSS N A

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:42 vuln.today

CVSS changed

May 27, 2026 - 19:37 NVD

4.3 (MEDIUM)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality

AnalysisAI

Cross-site scripting (XSS) in PbootCMS v.3.2.11 allows a high-privileged authenticated attacker to inject malicious JavaScript into the site configuration functionality, which executes in the browser of any user who subsequently views the affected configuration page. Despite the description using the term 'code injection,' CWE-79 and the XSS tag confirm this is a stored or reflected XSS class vulnerability, not arbitrary server-side code execution. A GitHub-hosted proof-of-concept exists (TazmiDev/CVE-2026-36239), and no public patch has been identified at time of analysis; no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

PbootCMS is a PHP-based open-source CMS. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the application fails to sanitize or encode user-supplied input before rendering it in a browser context, specifically within the site configuration panel. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U) confirms network-delivered exploitation requiring high privileges and victim user interaction - consistent with stored XSS where an admin plants a payload that fires when another user loads the configuration view. Notably, the description uses the phrase 'code injection,' which may be imprecise vendor/reporter language for script injection via XSS; CWE-79 and the 'XSS' tag are the authoritative classification here. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and carries no useful product-identification information; affected product scope is derived from the description alone.

RemediationAI

No vendor-released patch has been identified at time of analysis. Administrators should monitor http://pbootcms.com and the project's official repository for a patched release. As a compensating control, restrict access to the site configuration functionality to the minimum number of trusted administrator accounts, since exploitation requires PR:H (high-privileged) access - reducing the admin population directly reduces attack surface. Implement Content Security Policy (CSP) headers to limit the impact of any injected scripts; however, CSP may interfere with legitimate CMS JavaScript functionality and should be tested before deployment. Additionally, audit current site configuration fields for unexpected or anomalous script tags, particularly if multiple administrators share the system. The GitHub POC at https://github.com/TazmiDev/CVE-2026-36239 can be used to test whether a given deployment is vulnerable after compensating controls are applied.