CVE-2019-25630

8.7 highEPSS 0.9%

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2026-03-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phreesoft:phreebookserp

References

https://sourceforge.net/projects/phreebooks/files/latest/download
https://www.exploit-db.com/exploits/46644
https://www.phreesoft.com/
https://www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-manager

Check your stack JSON