A flaw in PbootCMS version 3.2.11’s site configuration feature allows an attacker to supply values that are processed and executed by the underlying server. The weakness is a code injection vulnerability (CWE‑79). The CVSS score of 4.3 indicates a low severity but the potential for unauthorized code execution remains a concern.

The vulnerability applies to the PbootCMS content management system, version 3.2.11. No other products, vendors or version ranges are listed as affected.

The low CVSS score (4.3) and an EPSS value below 1 % suggest a small exploitation chance; the issue is not catalogued in the CISA KEV list. The attack likely proceeds through the administrative site‑configuration interface, which typically requires authenticated access. If the attacker obtains or exploits such access, arbitrary code could run on the server, potentially leading to further compromise.