Which versions of PHP are affected by CVE-2026-4508?

PbootCMS installations are vulnerable to remote SQL injection attacks that could expose, modify, or delete sensitive customer and business data without requiring authentication.

Is there a public PoC exploit available for CVE-2026-4508?

Yes, a public proof-of-concept exploit is available for CVE-2026-4508. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4508?

Within 24 hours: Identify all systems running PbootCMS and their version numbers; isolate affected instances from production if possible and implement emergency WAF rules to block malicious SQL patterns in the Username parameter. Within 7 days: Apply input validation controls, disable the Member Login component if not business-critical, and conduct a forensic review of access logs for signs of exploitation. Within 30 days: Migrate to an alternative CMS platform or await an official vendor patch; if continuing with PbootCMS, implement comprehensive database activity monitoring and conduct a full security audit of potentially compromised data.

PHP CVE-2026-4508

Q: What is the CVSS score of CVE-2026-4508?

CVE-2026-4508 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13931 MEDIUM

SQL Injection (CWE-89)

2026-03-20 VulDB

PHP SQLi Pbootcms N A

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:32 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 23:01 euvd

EUVD-2026-13931

Analysis Generated

Mar 20, 2026 - 23:01 vuln.today

CVE Published

Mar 20, 2026 - 22:32 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.php of the component Member Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in PbootCMS versions up to 3.2.12 allows unauthenticated remote attackers to manipulate the Username parameter in the Member Login function, potentially enabling unauthorized database access and data manipulation. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

PbootCMS is a PHP-based content management system. This vulnerability affects the member authentication mechanism, specifically the checkUsername function in apps/home/controller/MemberController.php. The root cause is CWE-89 (SQL Injection), where user-supplied input from the Username parameter is not properly sanitized or parameterized before being used in SQL queries. This allows attackers to break out of the intended query structure and execute arbitrary SQL commands against the backend database. The affected product is identified via CPE as cpe:2.3:a:n/a:pbootcms:*:*:*:*:*:*:*:*, confirming all versions up to and including 3.2.12 are vulnerable.

RemediationAI

As of this analysis, no official patch or vendor advisory has been released by the PbootCMS development team (CVSS RL:X indicates remediation level unavailable). Organizations should monitor the official PbootCMS repository and website for security updates addressing this SQL injection flaw. Until an official patch is available, implement defense-in-depth measures including: deploying a web application firewall (WAF) with rules to detect and block SQL injection attempts targeting the member login functionality, restricting access to the member login interface to trusted IP ranges if feasible, implementing prepared statements or parameterized queries if modifying the source code is an option, and conducting thorough input validation on the Username parameter. Consider disabling the member login feature entirely if it is not essential to operations. Monitor database and application logs for suspicious authentication attempts or SQL error messages that may indicate exploitation attempts.