CVE-2025-48743 is a medium severity SQL injection (CVSS 5.3) in SIGB PMB, the library management software, in versions before 8.0.1.2. The record gives no more detail than that. The change log lists the fix in 8.0.1.2, so upgrade to that release or a newer one.
What's affected
The CVE record says SIGB PMB before 8.0.1.2 is affected. The PMB change log for 8.0.1.2, dated 3 March 2025, lists security entries that match this CVE and the two related ones assigned at the same time: a fix for an SQL injection, a fix in the installer program that allowed remote code execution, and a fix for file inclusion that allowed remote code execution. The CVSS vector in the record shows no privileges required and a limited confidentiality impact.
PMB is a library management system published under the SIGB name. The change log shows many later releases, up to 8.0.1.29 dated 16 March 2026, so you can move well past 8.0.1.2. Plan the upgrade to the newest release the vendor supports for your setup.
How to check if you're exposed
Find where PMB is installed and which version it runs. Look for the version in your PMB administration screens, or in the installed files that your package or deployment records.
find / -type d -name "pmb" 2>/dev/null | head
If the installation is older than 8.0.1.2, you are in the affected range. Then check how it is exposed. PMB usually has a public catalogue (OPAC) and a staff back office. Ask which of these is reachable from the internet, and whether the installer is still reachable on a production system.
Look at your web server logs for requests to unusual PMB paths, and for database errors in the application log. The change log line reads as a correction of an SQL injection. The record does not name the file or the parameter, so rely on the fixed release rather than on code level checks.
What to do now
- Identify every PMB instance, including old test copies, and record the version.
- Upgrade to the newest supported release, and at minimum 8.0.1.2. Back up the database and files first, and test local customisations.
- Restrict the back office and any setup or installer paths to the networks that need them, using your web server or firewall.
- As general hardening, remove or block installer scripts from a finished production installation if the vendor documentation allows it.
- Review logs and the file system for unexpected changes, and rotate database and admin passwords if you see signs of abuse.
Why it matters
The record lists the weakness as CWE-89, SQL injection. The CVSS score is Medium, but the record text describes code execution in two of the three related issues, which is why this should not wait for a quiet period. A Medium score can be low because the attack needs unusual conditions, not because the result is mild.
The three CVEs were published together on 27 May 2025, after the fix shipped on 3 March 2025. That is the pattern to watch for: a fixed release can exist for months before the CVE appears, so scanners that only look at recent CVEs miss old installs. Search by product and version.
None of the three is listed in the CISA Known Exploited Vulnerabilities catalogue, and I found no statement of exploitation in the sources.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes this issue?
The record says versions before 8.0.1.2 are affected, and the PMB change log lists the security fixes in 8.0.1.2. Newer releases exist, so upgrade to the latest supported one.
Are the three PMB CVEs the same bug?
No. The change log lists three separate security entries, and the record gives each CVE its own weakness: SQL injection, an installer issue and file inclusion.
Sources
Last reviewed: 18 October 2026.
