CVE-2022-34328

PMB 7.3.10 is affected by a reflected XSS vulnerability in the id parameter of an lvl=author_see request to index.php. The underlying issue is missing input filtering/escaping in PMB’s index.php path, allowing an attacker to inject scripts that could be executed in a victim’s browser (e.g., leadi...

CVE-2023-24735

PMB 7.4.6 contains an open redirect vulnerability in the /opac_css/pmb.php component. A crafted URL can redirect victims to an external domain, with potential exposure to sensitive information, data modification, or unauthorized operations. The issue is documented as CVE-2023-24735 (CVSS v3.1 bas...

CVE-2024-26289

The CVE-2024-26289 issue is a Deserialization of Untrusted Data vulnerability in PMB Services PMB that enables Remote Code Inclusion. Concrete details from connected documents: affected PMB versions are 7.3.1–7.3.18, 7.4.1–7.4.9, and 7.5.1–7.5.6-2. Root cause is deserialization of untrusted data....

CVE-2023-24733

PMB v7.4.6 has a reflected Cross-Site Scripting (XSS) vulnerability via the query parameter in /admin/convert/export_z3950_new.php. An attacker can inject arbitrary script into the browser context of the affected site, potentially stealing cookie-based authentication credentials, enabling session...

CVE-2023-24737

PMB v7.4.6 contains a reflected XSS via the query parameter on /admin/convert/export_z3950.php (export_z3950.php). The issue, documented across sources (NVD/Nuclei), is caused by insufficient input sanitization of the query parameter, enabling injected scripts to run in users’ browsers. Impact pe...

CVE-2025-0473

CVE-2025-0473 describes a vulnerability in PMB platform where the file upload at /pmb/authorities/import/iimport_authorities creates a temporary file that is deleted after a POST to the same endpoint, but an attacker can trap the second POST to prevent deletion, causing persistence of temporary f...

CVE-2023-24734

PMB v7.4.6 is affected by an arbitrary file upload vulnerability in the camera_upload.php component that enables attackers to execute arbitrary code via a crafted image file. Affected product/entity: PMB 7.4.6; vulnerable component: camera_upload.php. Root cause not explicitly stated beyond “arbi...

CVE-2023-46474

Affected software : PMB v7.4.8. Vulnerability : file upload vulnerability enabling remote code execution and privilege escalation via a crafted PHP file uploaded to the start_import.php file. The underlying issue is an unlimited file upload vector that permits arbitrary code execution. Impact : r...

CVE-2023-51828

CVE-2023-51828 concerns PMB (Paper Management/Bibliography) prior to version 7.4.7 where a SQL injection exists in the admin/convert/export.class.php file. The vulnerability allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in the get_next_notice fu...

CVE-2025-0471

The CVE-2025-0471 entry concerns PMB platform unrestricted file upload allowing remote access and command execution. Affected versions include 4.0.10 and later (CNNVD cites up to 4.2.13). The underlying issue is unrestricted file upload in PMB platform, enabling an attacker to upload a file to ga...

CVE-2023-24736

PMB v7.4.6 contains a remote code execution (RCE) vulnerability in the component /sauvegarde/restaure_act.php. The issue is exposed over a network vector with no user interaction required and privileges. Documented impact indicates high/critical potential (C:H/I:H/A:H), but exploitation status is...

CVE-2023-52154

CVE-2023-52154 affects PMB 7.4.7 and earlier, with a file upload vulnerability in pmb/camera_upload.php that allows an attacker to upload crafted PHTML files to achieve arbitrary code execution. The Red Hat and NVD entries corroborate the vulnerability description; no exploitation details or affe...

CVE-2025-0472

The connected sources confirm a CVE-2025-0472 information-exposure vulnerability in the PMB platform, affecting versions up to 4.2.13. The issue allows an attacker to upload a file to the environment and enumerate internal machine files by inspecting the request response. The root cause is descri...

CVE-2025-48742

The CVE-2025-48742 affects SIGB PMB installers prior to version 8.0.1.2, where the installer component allows remote code execution. Impact is described as remote code execution with network access and no user interaction; remediation is to upgrade to 8.0.1.2 or later. Connected reports also conf...

CVE-2025-48744

SIGB PMB prior to 8.0.1.2 is affected by a Local File Inclusion vulnerability that can lead to remote code execution. The issue affects SIGB PMB versions before 8.0.1.2, with CVSS3.1 base metrics indicating high impact (Confidentiality/Integrity/Availability: High; Score up to 9.8 per NVD). There...

CVE-2025-48743

SIGB PMB contains a SQL injection vulnerability in versions prior to 8.0.1.2. The issue stems from input handling that allows SQL injection. Impact indicators in the sources show high confidentiality, integrity, and availability impacts (NVD CVSSv3.1 base score 9.8; another assessment shows base ...

CVE-2023-37177

CVE-2023-37177 is a SQL injection affecting PMB Services PMB v.7.4.7 and earlier. The flaw permits a remote, unauthenticated attacker to execute arbitrary code via the query parameter in /admin/convert/export_z3950.php. Affected component: PMB PMB software; root cause: unsafeguarded input handlin...

CVE-2023-38844

CVE-2023-38844 affects PMB (PMB Services/popular PMB library management system) up to v7.4.7. The vulnerability is an SQL injection in export_skos.php via the thesaurus parameter, enabling remote code execution. The CVSS metrics indicate high impact to confidentiality with no impact on integrity ...

CVE-2023-52155

PMB 7.4.7 and earlier are affected by a SQL Injection in /admin/sauvegarde/run.php via the sauvegardes parameter. The issue allows remote authenticated attackers to execute arbitrary SQL commands. The vulnerable component is the /admin/sauvegarde/run.php endpoint; root cause and exact vulnerabili...

CVE-2023-52153

Summary: CVE-2023-52153 is a SQL injection vulnerability in PMB 7.4.7 and earlier, located in /pmb/opac_css/includes/sessions.inc.php, exploitable via the PmbOpac-LOGIN cookie value. Technical details from connected documents: Remote unauthenticated attackers could inject arbitrary SQL commands t...

CVE-2025-61168

CVE-2025-61168 affects SIGB PMB 8.0.1.14 in the cms_rest.php component. The issue allows attackers to execute arbitrary code via unserializing an arbitrary file, as described across multiple sources. The connected documents do not specify a patch version or remediation, nor enumerate exploit deta...

CVE-2023-53982

CVE-2023-53982 concerns PMB 7.4.6, where a SQL injection exists in the storage parameter of the ajax.php endpoint. The vulnerability stems from an unsanitized or improperly handled ‘id’ parameter, enabling remote attackers to manipulate database queries and potentially perform time-based blind SQ...

CVE-2025-61167

SIGB PMB v8.0.1.14 contains multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component, exploitable via the id and datas parameters. Root cause: improper handling of user-supplied input in that endpoint allows SQL commands to be injected, potentially leading to unauthoriz...