{"id":"CVE-2024-26289","aliases":["EUVD-2024-23560"],"status":"published","title":"Remote Code Inclusion Vulnerability in Multiple PMB Versions","description":"Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00609,"percentile":0.49643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2024-05-27T07:01:52Z","modified":"2026-06-17T07:17:32Z","products":[{"vendor":"pmb services","product":"pmb"},{"vendor":"pmb_services","product":"pmb"},{"vendor":"redmine","product":"pmb"},{"vendor":"sigb","product":"pmb"}],"references":[{"url":"https://github.com/enisaeu/CNW/blob/main/advisories/2024/CNW-2024-A-12.md","tags":["third-party-advisory","x_transferred","Third Party Advisory"]},{"url":"https://forge.sigb.net/projects/pmb/files","tags":["product","x_transferred","Product"]}],"sources":{"cve":[{"id":"CVE-2024-26289","title":"Remote Code Inclusion Vulnerability in Multiple PMB Versions","description":"Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.","status":"published","published":"2024-05-27T07:01:52.386Z","modified":"2024-08-02T00:07:19.301Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-23560","description":"Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.","status":"published","published":"2024-05-27T07:01:52Z","modified":"2024-08-02T00:07:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:27.742015Z"}],"nvd":[{"id":"CVE-2024-26289","description":"Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.","status":"published","published":"2024-05-27T07:15:08.807Z","modified":"2026-06-17T07:17:32.883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:10:02.520903Z"}]}}