Which versions of PHP are affected by CVE-2026-4510?

Organizations using PbootCMS should be aware of moderate risk from CVE-2026-4510, a cross-site scripting vulnerability rated CVSS 4.3.

Is there a public PoC exploit available for CVE-2026-4510?

Yes, a public proof-of-concept exploit is available for CVE-2026-4510. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4510?

Within 30 days: Identify affected systems running PbootCMS and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-4510

Q: What is the CVSS score of CVE-2026-4510?

CVE-2026-4510 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14242 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 VulDB

GHSA-89w6-5gpp-wfvp

PHP XSS Pbootcms N A

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 07:15 euvd

EUVD-2026-14242

Analysis Generated

Mar 21, 2026 - 07:15 vuln.today

CVE Published

Mar 21, 2026 - 07:02 nvd

MEDIUM 4.3

DescriptionCVE.org

A weakness has been identified in PbootCMS up to 3.2.12. This impacts the function alert_location of the file apps/home/controller/MemberController.php of the component Parameter Handler. This manipulation of the argument backurl causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

A reflected cross-site scripting (XSS) vulnerability exists in PbootCMS versions up to 3.2.12 in the alert_location function of the MemberController.php file, where the backurl parameter is not properly sanitized before output. An attacker can craft a malicious URL containing JavaScript code that will execute in a victim's browser when they click the link, potentially leading to session hijacking, credential theft, or malware distribution. A public proof-of-concept exploit is available on GitHub, increasing the risk of active exploitation.

Technical ContextAI

PbootCMS is a PHP-based content management system. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled input from the backurl parameter flows unsanitized into the output context of the alert_location function in apps/home/controller/MemberController.php. The affected product is identified via CPE as cpe:2.3:a:n/a:pbootcms:*:*:*:*:*:*:*:*, indicating all versions up to 3.2.12 are vulnerable. This is a classic reflected XSS vulnerability common in PHP applications that lack proper input validation and output encoding mechanisms, particularly in redirect or notification handling code.

RemediationAI

Upgrade PbootCMS to a version newer than 3.2.12 as soon as a patched release becomes available from the vendor. Immediate mitigations pending a patch include: (1) implement output encoding for all user-supplied parameters, particularly the backurl parameter, using PHP functions such as htmlspecialchars() with ENT_QUOTES flag; (2) apply Content Security Policy (CSP) headers with strict-dynamic or script-nonce directives to prevent inline script execution; (3) validate the backurl parameter against a whitelist of allowed domains to prevent open redirect and XSS chaining; (4) deploy a Web Application Firewall (WAF) with rules to detect and block common XSS payloads in the backurl parameter. Monitor vendor security advisories and the GitHub repository for patch releases and apply them immediately upon availability.