PbootCMS version 3.2.15 contains a flaw that permits an attacker to inject and execute arbitrary PHP code through several core controller files, including MemberController, UserController, CommentController, ContentController, and helper.php. Based on the description, it is inferred that attackers can run arbitrary PHP code on the CMS host, gaining full control of the server and all data it stores.

Any deployment of PbootCMS 3.2.15 is vulnerable. The issue affects the core PHP controllers listed in the description, and there is no evidence that later releases mitigate the problem, so installations of 3.2.15 must be reviewed.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of <1% suggests a currently low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The nature of the flaw – remote code execution – indicates a high potential impact. Based on the description, it is inferred that attackers might trigger the vulnerability by sending crafted HTTP requests to the affected controller URLs. Since the flaw is in the application layer, it can be exploited from any network location that can reach the CMS web interface.