We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2019-25630

CVE-2019-25630

PHP

Severity: HIGH
CVSS: 8.8CVSS
Published: 2026-03-24
Last modified: 2026-03-26
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

References

https://sourceforge.net/projects/phreebooks/files/latest/download
https://www.exploit-db.com/exploits/46644
https://www.phreesoft.com/
https://www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-manager

Summary

Description

References