PbootCMS version 3.2.11 contains a code injection flaw in its site configuration feature, allowing an attacker to provide input that is executed by the server. This vulnerability can enable unauthorized code execution, data disclosure, or service disruption. The weakness is caused by improper handling of user-supplied configuration values and is classified under CWE-94.

The vulnerability affects the PbootCMS content management system, specifically the 3.2.11 release. No other product versions or vendors are listed as affected.

The CVSS score is not supplied by the CNA; the EPSS score is unavailable, indicating no known exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through malicious input submitted via the site configuration interface, which may require authenticated access to the administrative panel. Attackers would aim to inject code that is then executed by the server, potentially leading to unauthorized code execution, data disclosure, or service disruption.