Vulnerabilities

TI-2020-19105 CVE-2020-36970 · GHSA-mc39-mcp7-82wg

PMB 5.6 - 'chemin' Local File Disclosure

LOW 32

PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00294 Published 2026-01-28 No fix listed CWE-22

TI-2025-00390 CVE-2025-0473 · GHSA-4vfx-xrp7-4c4h

Incomplete Cleanup vulnerability in PMB platform

LOW 33

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00476 Published 2025-01-16 No fix listed CWE-459

TI-2025-00389 CVE-2025-0472 · GHSA-v5ff-x4g7-3gqc

Information exposure vulnerability in PMB platform

LOW 39

Information exposure in the PMB platform affecting versions 4.2.13 and earlier.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00504 Published 2025-01-16 No fix listed CWE-200

TI-2025-00388 CVE-2025-0471 · GHSA-qcvg-j4c3-wxh2

Unrestricted Upload of File with Dangerous Type vulnerability in PMB platform

MEDIUM 44

Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00598 Published 2025-01-16 No fix listed CWE-434

TI-2024-17370 CVE-2024-26289

Remote Code Inclusion Vulnerability in Multiple PMB Versions

MEDIUM 50

Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00609 Published 2024-05-27 Fixed in 7.5.6-2, 7.4.9 +1 CWE-502

TI-2014-07684 CVE-2014-9457 · GHSA-4gxm-8q9g-qvqr

SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier…

LOW 31

SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the id parameter to catalog.php.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01055 Published 2015-01-02 No fix listed CWE-89

TI-2007-01357 CVE-2007-1415 · GHSA-xfwx-g8wm-38q3

Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier…

MEDIUM 45

Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) class_path parameter to (a) includes/resa_func.inc.php (b) a…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.09455 Published 2007-03-12 No fix listed CWE-94