CVE-2022-34328

PMB 7.3.10 is affected by a reflected XSS vulnerability in the id parameter of an lvl=author_see request to index.php. The underlying issue is missing input filtering/escaping in PMB’s index.php path, allowing an attacker to inject scripts that could be executed in a victim’s browser (e.g., leadi...

CVE-2024-26289

The CVE-2024-26289 issue is a Deserialization of Untrusted Data vulnerability in PMB Services PMB that enables Remote Code Inclusion. Concrete details from connected documents: affected PMB versions are 7.3.1–7.3.18, 7.4.1–7.4.9, and 7.5.1–7.5.6-2. Root cause is deserialization of untrusted data....

CVE-2023-24733

PMB v7.4.6 has a reflected Cross-Site Scripting (XSS) vulnerability via the query parameter in /admin/convert/export_z3950_new.php. An attacker can inject arbitrary script into the browser context of the affected site, potentially stealing cookie-based authentication credentials, enabling session...

CVE-2023-24735

PMB 7.4.6 contains an open redirect vulnerability in the /opac_css/pmb.php component. A crafted URL can redirect victims to an external domain, with potential exposure to sensitive information, data modification, or unauthorized operations. The issue is documented as CVE-2023-24735 (CVSS v3.1 bas...

CVE-2023-24737

PMB v7.4.6 contains a reflected XSS via the query parameter on /admin/convert/export_z3950.php (export_z3950.php). The issue, documented across sources (NVD/Nuclei), is caused by insufficient input sanitization of the query parameter, enabling injected scripts to run in users’ browsers. Impact pe...

CVE-2023-46474

Affected software : PMB v7.4.8. Vulnerability : file upload vulnerability enabling remote code execution and privilege escalation via a crafted PHP file uploaded to the start_import.php file. The underlying issue is an unlimited file upload vector that permits arbitrary code execution. Impact : r...

CVE-2025-0471

The CVE-2025-0471 entry concerns PMB platform unrestricted file upload allowing remote access and command execution. Affected versions include 4.0.10 and later (CNNVD cites up to 4.2.13). The underlying issue is unrestricted file upload in PMB platform, enabling an attacker to upload a file to ga...

CVE-2023-51828

A SQL Injection vulnerability exists in PMB versions 7.4.7 and earlier . The flaw is located in the /admin/convert/export.class.php file within the get_next_notice function. This vulnerability allows remote unauthenticated attackers to execute arbitrary SQL commands by exploiting a vulnerable que...

CVE-2023-24734

PMB v7.4.6 is affected by an arbitrary file upload vulnerability in the camera_upload.php component that enables attackers to execute arbitrary code via a crafted image file. Affected product/entity: PMB 7.4.6; vulnerable component: camera_upload.php. Root cause not explicitly stated beyond “arbi...

CVE-2025-0473

CVE-2025-0473 describes a vulnerability in PMB platform where the file upload at /pmb/authorities/import/iimport_authorities creates a temporary file that is deleted after a POST to the same endpoint, but an attacker can trap the second POST to prevent deletion, causing persistence of temporary f...

CVE-2023-52154

The PMB document management system (versions 7.4.7 and earlier ) is vulnerable to a file upload flaw in the pmb/camera_upload.php component. An unauthenticated, remote attacker can exploit this by uploading a crafted PHTML file to execute arbitrary code on the target system. The provided document...

CVE-2023-24736

PMB v7.4.6 contains a remote code execution (RCE) vulnerability in the component /sauvegarde/restaure_act.php. The issue is exposed over a network vector with no user interaction required and privileges. Documented impact indicates high/critical potential (C:H/I:H/A:H), but exploitation status is...

CVE-2025-0472

The connected sources confirm a CVE-2025-0472 information-exposure vulnerability in the PMB platform, affecting versions up to 4.2.13. The issue allows an attacker to upload a file to the environment and enumerate internal machine files by inspecting the request response. The root cause is descri...

CVE-2025-48742

The CVE-2025-48742 affects SIGB PMB installers prior to version 8.0.1.2, where the installer component allows remote code execution. Impact is described as remote code execution with network access and no user interaction; remediation is to upgrade to 8.0.1.2 or later. Connected reports also conf...

CVE-2025-48744

SIGB PMB prior to 8.0.1.2 is affected by a Local File Inclusion vulnerability that can lead to remote code execution. The issue affects SIGB PMB versions before 8.0.1.2, with CVSS3.1 base metrics indicating high impact (Confidentiality/Integrity/Availability: High; Score up to 9.8 per NVD). There...

CVE-2023-38844

A SQL injection vulnerability exists in PMB version v.7.4.7 and earlier . The flaw originates from the thesaurus parameter within the export_skos.php file, which allows an unauthenticated, remote attacker to execute arbitrary code . While the documentation confirms the existence of the vulnerabil...

CVE-2023-52155

PMB versions 7.4.7 and earlier are affected by a SQL Injection vulnerability in the /admin/sauvegarde/run.php endpoint. This flaw allows remote authenticated attackers to execute arbitrary SQL commands by manipulating the sauvegardes variable. Successful exploitation can lead to unauthorized data...

CVE-2025-48743

SIGB PMB contains a SQL injection vulnerability in versions prior to 8.0.1.2. The issue stems from input handling that allows SQL injection. Impact indicators in the sources show high confidentiality, integrity, and availability impacts (NVD CVSSv3.1 base score 9.8; another assessment shows base ...

CVE-2023-52153

A SQL Injection vulnerability exists in the PMB document management system, version 7.4.7 and earlier . The flaw is located in the /pmb/opac_css/includes/sessions.inc.php file, where a lack of proper input neutralization allows remote unauthenticated attackers to inject arbitrary SQL commands via...

CVE-2023-37177

PMB Services PMB versions v.7.4.7 and before are vulnerable to a SQL Injection vulnerability (CWE-89). A remote unauthenticated attacker can exploit the query parameter in the /admin/convert/export_z3950.php endpoint to execute arbitrary code and perform unauthorized actions on the system. While ...

CVE-2023-53982

CVE-2023-53982 concerns PMB 7.4.6, where a SQL injection exists in the storage parameter of the ajax.php endpoint. The vulnerability stems from an unsanitized or improperly handled ‘id’ parameter, enabling remote attackers to manipulate database queries and potentially perform time-based blind SQ...

CVE-2025-61168

The SIGB PMB open-source integrated library management system, specifically version v8.0.1.14 , contains a critical security vulnerability in the cms_rest.php component. The root cause is the unserialization of an arbitrary file , which can be exploited by an attacker to achieve arbitrary code ex...

CVE-2025-61167

SIGB PMB version v8.0.1.14 contains multiple SQL injection vulnerabilities within the /opac_css/ajax_selector.php component. These flaws are triggered via the id and datas parameters, where improper handling of crafted input may allow for unauthorized database access or modification. Remediation ...