Vulnerabilities
23 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-53982 | PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks. NVD description · AI analysis pending | 9.3 | <1% | PoC |
| — | |
| CVE-2025-61168 +1 in the same advisory: …61167 | An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. NVD description · AI analysis pending | 9.8 group max | <1% |
| — | ||
| CVE-2025-48744 | In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2025-0471 | Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to gain remote access to the machine, being able to access, modify and execute commands freely. NVD description · AI analysis pending | 9.8 group max | <1% |
| — | ||
| CVE-2024-26289 | Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2023-37177 | SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/export_z3950.php endpoint. NVD description · AI analysis pending | 9.8 group max | 1% | PoC |
| — | |
| CVE-2023-46474 | File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_im File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file. NVD description · AI analysis pending | 7.2 | 21% | PoC |
| — | |
| CVE-2023-24734 | An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file. An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file. NVD description · AI analysis pending | 9.8 group max | 21% | PoC |
| — | |
| CVE-2022-34328 | PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php. PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php. NVD description · AI analysis pending | 6.1 | 2% | PoC |
| — |