PatchTheCVEpmb vulnerabilities and fixes
Recent CVEs affecting pmb, with upgrade or downgrade steps. 10 tracked.
pmb has 10 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 5. Most recent: 2025-12-23. Highest priority: CVE-2024-26289 (score 52/100).
- CVE-2023-53982 HIGH 7.5 DOWNGRADE PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of
- CVE-2025-61168 CRITICAL 9.8 DOWNGRADE An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via un
- CVE-2025-61167 MEDIUM 6.5 DOWNGRADE SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_sele
- CVE-2025-48744 MEDIUM 6.4 UPGRADE In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution.
- CVE-2025-48743 MEDIUM 5.3 UPGRADE SIGB PMB before 8.0.1.2 allows SQL injection.
- CVE-2025-48742 MEDIUM 5.4 UPGRADE The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution.
- CVE-2025-0473 MEDIUM 6.5 DOWNGRADE Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting
- CVE-2025-0472 HIGH 7.5 UPGRADE Information exposure in the PMB platform affecting versions 4.2.13 and earlier
- CVE-2025-0471 CRITICAL 9.9 DOWNGRADE Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above
- CVE-2024-26289 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue af
FAQ
How do I fix pmb vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pmb being exploited right now?
None of the tracked pmb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pmb CVE should I patch first?
CVE-2024-26289 currently ranks highest (52/100): Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue af.