VULNERABILITY INTELLIGENCE

CVE-2025-15154

CVSS score5.3 MEDIUM

EPSS probability0.25%

CISA KEVNot currently listed

Published2025-12-28

Last modified2026-10-13

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to use of less trusted source. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Weakness classification

cna@vuldb.com: CWE-348
nvd@nist.gov: CWE-345

Primary references

cna@vuldb.com — Exploit, Third Party Advisory
cna@vuldb.com — Permissions Required, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry