CVE-2022-34328

Deeper analysis

PMB version 7.3.10 contains a reflected cross-site scripting vulnerability (CWE-79) that can be triggered through the id parameter when an lvl=author_see request is sent to index.php. The flaw affects the open-source PMB library-management application and carries a CVSS 3.1 base score of 6.1, reflecting network attack vector, low complexity, and the requirement for user interaction.

An unauthenticated remote attacker can craft a malicious link containing the payload and deliver it to a victim user; if the user follows the link, the attacker’s script executes in the context of the PMB site, enabling theft of session tokens, redirection, or other client-side actions that affect the confidentiality and integrity of the victim’s interaction with the application.

The supplied references point only to the project repository and contain no advisory text or patch guidance. The associated EPSS score has remained flat at 0.0598 with no observed increase after disclosure.