CVE-2019-25709

🗓️ 12 Apr 2026 12:28:54Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

CVE-2019-25709: Unauthenticated access to the database allows downloading the imgdb file and deleting all pictures.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2019-25709	12 Apr 202612:28	–	attackerkb
Circl	CVE-2019-25709	12 Apr 202604:16	–	circl
CNNVD	CF Image Hosting Script 安全漏洞	12 Apr 202600:00	–	cnnvd
Cvelist	CVE-2019-25709 CF Image Hosting Script 1.6.5 Unauthorized Database Access	12 Apr 202612:28	–	cvelist
EUVD	EUVD-2019-20141	12 Apr 202615:30	–	euvd
NVD	CVE-2019-25709	12 Apr 202613:16	–	nvd
Positive Technologies	PT-2026-32171	12 Apr 202600:00	–	ptsecurity
Vulnrichment	CVE-2019-25709 CF Image Hosting Script 1.6.5 Unauthorized Database Access	12 Apr 202612:28	–	vulnrichment

NVD

Vulners

CNA

Node

codefuture image_hosting_scriptMatch1.6.5

[
  {
    "vendor": "Davidtavarez",
    "product": "CF Image Hosting Script",
    "versions": [
      {
        "version": "1.6.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
forum	www.forum.codefuture.co.uk/showthread.php
vulncheck	www.vulncheck.com/advisories/cf-image-hosting-script-unauthorized-database-access
davidtavarez	www.davidtavarez.github.io/
exploit-db	www.exploit-db.com/exploits/46094

Parameter	Position	Path	Description	CWE
d	path	upload/data/imgdb.db	Unauthenticated access to the application database file (imgdb.db) in upload/data enables downloading/decoding of the database and extraction of plaintext delete IDs, which can be used with the d parameter to delete all pictures.	CWE-552

23 Apr 2026 20:22Current

5.8Medium risk

Vulners AI Score5.8

CVSS 49.3

CVSS 3.19.8

EPSS0.00564

SSVC

CWE-552