41-trk

2 exploits Active since Jan 2026
CVE-2020-37105 EXPLOITDB HIGH text WRITEUP
PMB 5.6 - Authenticated SQL Injection via logid Parameter
PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database.
CVSS 7.1
CVE-2020-36970 EXPLOITDB HIGH text WORKING POC
PMB Services 5.6 - Path Traversal and Arbitrary File Read via getgif.php chemin Parameter
PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' parameter. Attackers can exploit the unsanitized file path input to access sensitive files like /etc/passwd by sending crafted requests to the getgif.php endpoint.
CVSS 8.4