PMB Services vulnerabilities
We track 5 vulnerabilities in PMB Services products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on January 16, 2025.
Latest PMB Services vulnerabilities
- 7.5 High severity
PMB platform: Incomplete Cleanup
Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. W
- 7.5 High severity
PMB platform: Unrestricted Upload of File with Dangerous Type
Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and enumerate the internal files of a machine by looking at the request response.
- 9.8 Critical severity
PMB platform: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to gain remote access to the machine, being able to access, modify and execute commands freely.
- 9.8 Critical severity
PMB: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
- 9.8 Critical severity
pmb: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via the query parameter in the /admin/convert/export_z3950.php endpoint.