Priority MEDIUM 50
Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
PMB Services
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
PMB Services records in CISA KEVNo PMB Services vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2007-01357 CVE-2007-1415 · GHSA-xfwx-g8wm-38q3
Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier…
Priority MEDIUM 45
Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) class_path parameter to (a) includes/resa_func.inc.php (b) a…
TI-2025-00388 CVE-2025-0471 · GHSA-qcvg-j4c3-wxh2
Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform
Priority MEDIUM 44
Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above.
TI-2025-00389 CVE-2025-0472 · GHSA-v5ff-x4g7-3gqc
Information exposure vulnerability in PMB platform
Priority LOW 39
Information exposure in the PMB platform affecting versions 4.2.13 and earlier.
TI-2025-00390 CVE-2025-0473 · GHSA-4vfx-xrp7-4c4h
Incomplete Cleanup vulnerability in PMB platform
Priority LOW 33
Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above.
TI-2020-19105 CVE-2020-36970 · GHSA-mc39-mcp7-82wg
PMB 5.6 - 'chemin' Local File Disclosure
Priority LOW 32
PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter.
TI-2014-07684 CVE-2014-9457 · GHSA-4gxm-8q9g-qvqr
SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier…
Priority LOW 31
SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the id parameter to catalog.php.