Pmweb
Monthly
Information disclosure in PMWeb v7.x, v8.x, and v2025.x allows a remote, unauthenticated attacker to extract sensitive data by manipulating an unspecified function inside the encryptionhelper.dll library. The vulnerability was disclosed to the vendor, who did not respond, so no vendor-released patch has been identified at the time of analysis and no public exploit code was identified either. The confidentiality impact is limited (VC:L) with no integrity or availability effect, making this a low-priority issue in practice - real-world exposure depends on whether a given PMWeb instance is reachable from untrusted networks, since the product is normally deployed behind corporate access controls.
Path traversal in PMWeb 7.x, 8.x, and 2025.x lets unauthenticated remote attackers read files from the server filesystem by supplying traversal sequences in the FullFileName or FileName argument of downloader.aspx. The issue is rated CVSS v4.0 6.9 and independently assessed as CVSS v3.1 6.9 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), i.e. a network-reachable, no-authentication, read-only file disclosure with high confidentiality impact and no integrity or availability impact. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV), and the vendor did not respond to the disclosure; practical risk is tempered by PMWeb's niche deployment in construction and capital-program organizations and the frequent internal or access-restricted placement of those instances.
A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Information disclosure in PMWeb v7.x, v8.x, and v2025.x allows a remote, unauthenticated attacker to extract sensitive data by manipulating an unspecified function inside the encryptionhelper.dll library. The vulnerability was disclosed to the vendor, who did not respond, so no vendor-released patch has been identified at the time of analysis and no public exploit code was identified either. The confidentiality impact is limited (VC:L) with no integrity or availability effect, making this a low-priority issue in practice - real-world exposure depends on whether a given PMWeb instance is reachable from untrusted networks, since the product is normally deployed behind corporate access controls.
Path traversal in PMWeb 7.x, 8.x, and 2025.x lets unauthenticated remote attackers read files from the server filesystem by supplying traversal sequences in the FullFileName or FileName argument of downloader.aspx. The issue is rated CVSS v4.0 6.9 and independently assessed as CVSS v3.1 6.9 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), i.e. a network-reachable, no-authentication, read-only file disclosure with high confidentiality impact and no integrity or availability impact. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV), and the vendor did not respond to the disclosure; practical risk is tempered by PMWeb's niche deployment in construction and capital-program organizations and the frequent internal or access-restricted placement of those instances.
A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.