CVE-2026-12066

PbootCMS Password MemberController.php retrieve password recovery

State: Published
Severity: 6.9 Medium
Published: Jun 12, 2026
Updated: Jun 12, 2026
Reserved: Jun 12, 2026

Description

A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-640 Weak Password Recovery

Affected Products

Product	Versions
PbootCMSn/a	3.2.0Affected 3.2.1Affected 3.2.2Affected 3.2.3Affected 3.2.4Affected 3.2.5Affected 3.2.6Affected 3.2.7Affected 3.2.8Affected 3.2.9Affected 3.2.10Affected 3.2.11Affected 3.2.12Affected

References

VDB-370561 | PbootCMS Password MemberController.php retrieve password recoveryvdb-entrytechnical-description
VDB-370561 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-12066 | CVE Analysis and Reportthird-party-advisory
Submit #828374 | PbootCMS 3.2.12 Improper Authenticationthird-party-advisory
https://github.com/pbootcmspro/PbootCMS/issues/38issue-tracking
https://github.com/yunyan05/MYCVE/tree/main/PbootCMS/V3.2.12-Account-Takeoverexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.