VYPR
← All vendors
Vendor

PMB

Products
3
CVEs
18
Across products
18
Status
Private

Products

3

Recent CVEs

18
  • CVE-2023-24734CriMar 6, 2023
    PMB
    PMB
    risk 0.65cvss 9.8epss 0.21

    An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file.

  • CVE-2025-0471CriJan 16, 2025
    PMB
    PMB platform
    risk 0.64cvss 9.9epss 0.01

    Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to gain remote access to the machine, being able to access, modify and execute commands freely.

  • CVE-2023-52153CriFeb 21, 2024
    PMB
    PMB
    risk 0.64cvss 9.8epss 0.01

    A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to inject arbitrary SQL commands via the PmbOpac-LOGIN cookie value.

  • CVE-2023-51828CriFeb 21, 2024
    PMB
    PMB
    risk 0.64cvss 9.8epss 0.01

    A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in get_next_notice function.

  • CVE-2023-24736CriMar 6, 2023
    PMB
    PMB
    risk 0.64cvss 9.8epss 0.02

    PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.

  • CVE-2020-36970HigJan 28, 2026
    PMB
    PMB
    risk 0.55cvss 8.4epss 0.00

    PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted…

  • CVE-2023-53982HigDec 23, 2025
    PMB
    PMB
    risk 0.49cvss 7.5epss 0.01

    PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information…

  • CVE-2025-0472HigJan 16, 2025
    PMB
    PMB platform
    risk 0.49cvss 7.5epss 0.01

    Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and enumerate the internal files of a machine by looking at the request response.

  • CVE-2023-38844HigFeb 21, 2024
    PMB
    PMB
    risk 0.49cvss 7.5epss 0.01

    SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in export_skos.php.

  • CVE-2023-46474HigJan 11, 2024
    PMB
    PMB
    risk 0.48cvss 7.2epss 0.21

    File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.

  • CVE-2023-52155HigFeb 21, 2024
    PMB
    PMB
    risk 0.47cvss 7.2epss 0.01

    A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via the sauvegardes variable through the /admin/sauvegarde/run.php endpoint.

  • CVE-2023-52154HigFeb 21, 2024
    PMB
    PMB
    risk 0.47cvss 7.2epss 0.01

    File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files.

  • CVE-2020-37105HigFeb 3, 2026
    PMB
    PMB
    risk 0.46cvss 7.1epss 0.00

    PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the…

  • CVE-2025-0473MedJan 16, 2025
    PMB
    PMB
    risk 0.42cvss 6.5epss 0.00

    Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. When a file is…

  • CVE-2023-24737MedMar 6, 2023
    PMB
    PMB
    risk 0.40cvss 6.1epss 0.01

    PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.

  • CVE-2023-24735MedMar 6, 2023
    PMB
    PMB
    risk 0.40cvss 6.1epss 0.01

    PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.

  • CVE-2023-24733MedMar 6, 2023
    PMB
    PMB
    risk 0.40cvss 6.1epss 0.01

    PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950_new.php.

  • CVE-2022-34328MedJun 23, 2022
    PMB
    PMB
    risk 0.40cvss 6.1epss 0.02

    PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php.