CVE-2019-25647

8.7 highEPSS 0.8%

High (8.7) in phreesoft phreebookserp. EPSS 0.8% chance of exploitation in the next 30 days.

PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2026-03-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phreesoft:phreebookserp

References

https://sourceforge.net/projects/phreebooks/
https://www.exploit-db.com/exploits/46645
https://www.phreesoft.com/
https://www.vulncheck.com/advisories/phreebooks-erp-remote-code-execution-via-image-manager

Check your stack JSON