The flaw lies in the alert_location function of MemberController.php in PbootCMS. An attacker can craft a URL that alters the backurl argument, inserting malicious script content. When a victim’s browser follows that URL, the injected script runs in the victim’s context, potentially stealing session tokens, defacing pages, or redirecting to malicious sites. The CVE description states that an exploit is publicly available, making the threat real and actionable.

All installations of PbootCMS up through version 3.2.12 are affected. The vulnerability resides in the Parameter Handler component located at apps/home/controller/MemberController.php. Users running any unsupported or older PbootCMS build should verify their version and apply updates if available.

The CVSS score of 5.3 reflects medium severity. No EPSS score is provided, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote: an attacker can deliver the exploit via a crafted URL. Because the exploit code is publicly available, the risk of widespread exploitation is present. Prompt patching or mitigations are recommended to reduce the attack surface.