CVE-2026-92381

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.23

Description A weakness in the Template Rendering component allows remote attackers to perform cross site scripting. The issue exists within the decode string() function located in the apps/admin/controller/content/ContentController.php file, where improper handling of the Title argument enables the attack.

Recommendations Update PbootCMS to version 3.2.23 or later. As a temporary mitigation, restrict access to the decode string() function in the apps/admin/controller/content/ContentController.php file.