CVE-2025-15154
EUVD-2025-20553028.12.2025, 21:15
A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to use of less trusted source. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| pbootcms | pbootcms | 𝑥 ≤ 3.2.12 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-348 - Use of Less Trusted SourceThe software has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
- CWE-345 - Insufficient Verification of Data AuthenticityThe software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.