CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39834
https://notcve.org/view.php?id=CVE-2023-39834
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function. • https://github.com/Pbootcms/Pbootcms/issues/8 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 1CVE-2018-19595
https://notcve.org/view.php?id=CVE-2018-19595
PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}&a=phpinfo(); URI, because of an incorrect apps\home\controller\ParserController.php parserIfLabel protection mechanism. PbootCMS V1.3.1, en su build del 14/11/2018, permite que los atacantes remotos ejecuten código arbitrario mediante el uso de "eval" con un caso mixto, tal y como queda demostrado con una URI index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}a=phpinfo();. Esto se debe a un mecanismo de protección parserIfLabel incorrecto en apps\home\controller\ParserController.php. • http://www.ttk7.cn/post-107.html https://www.pbootcms.com/changelog.html https://www.pbootcms.com/content/139.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •