CVE-2019-25630

🗓️ 24 Mar 2026 11:27:04Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 3 Views🌐 WEB

PhreeBooks ERP 5.2.3 arbitrary file upload in Image Manager enables authenticated attackers to upload PHP files and execute them via bizunoFS.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2019-25630	24 Mar 202611:27	–	attackerkb
Circl	CVE-2019-25630	24 Mar 202613:24	–	circl
CNNVD	PhreeSoft PhreeBooks ERP 跨站脚本漏洞	24 Mar 202600:00	–	cnnvd
Cvelist	CVE-2019-25630 PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager	24 Mar 202611:27	–	cvelist
EUVD	EUVD-2019-20000	24 Mar 202612:30	–	euvd
NVD	CVE-2019-25630	24 Mar 202612:16	–	nvd
Positive Technologies	PT-2026-27364	24 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2019-25630	26 Mar 202614:56	–	redhatcve
Vulnrichment	CVE-2019-25630 PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager	24 Mar 202611:27	–	vulnrichment

NVD

Vulners

Node

phreesoft phreebookserpMatch5.2.3

[
  {
    "vendor": "Phreesoft",
    "product": "PhreeBooks ERP",
    "versions": [
      {
        "status": "affected",
        "version": "5.2.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-manager
exploit-db	www.exploit-db.com/exploits/46644
phreesoft	www.phreesoft.com/
sourceforge	www.sourceforge.net/projects/phreebooks/files/latest/download

Parameter	Position	Path	Description	CWE
imgFile	parameter	bizuno/image/manager	Arbitrary file upload vulnerability allowing authenticated attackers to upload PHP files via the imgFile parameter and trigger remote code execution through the bizunoFS.php script.	CWE-434

26 Mar 2026 17:16Current

6.3Medium risk

Vulners AI Score6.3

CVSS 48.7

CVSS 3.18.8

EPSS0.003

SSVC

CWE-434