CVE-2026-79387

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.

• Published Sep 9, 2026
• CVSS 4.3 medium
• 0.3% chance of exploitation in the next 30 days (EPSS)

CVE-2026-79387 at the National Vulnerability Database