We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2019-25647

CVE-2019-25647

PHP

Severity: HIGH
CVSS: 8.8CVSS
Published: 2026-03-24
Last modified: 2026-03-25
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.

References

https://sourceforge.net/projects/phreebooks/
https://www.exploit-db.com/exploits/46645
https://www.phreesoft.com/
https://www.vulncheck.com/advisories/phreebooks-erp-remote-code-execution-via-image-manager

Summary

Description

References