CVE-2026-4509
Medium · 6.3CVSS
6.3
EPSS
0.4%
Published
Mar 21, 2026
CISA due date
—
The record
A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload. The manipulation of the argument black results in incomplete blacklist. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-183
- CVE-2026-54694 SkillTree is a micro-learning gamification platform. CWE-183
- CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-183
- CVE-2026-63649 The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through… CWE-183
- CVE-2026-67315 axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as… CWE-183
- CVE-2026-46608 Glances is an open-source system cross-platform monitoring tool. CWE-183
- CVE-2026-50189 Appsmith is a platform to build admin panels, internal tools, and dashboards. CWE-183
- CVE-2026-54316 Claude Code is an agentic coding tool. CWE-183