phpThumb - fltr Command Injection RCE (CVE-2010-1598)

Exploits CVE-2010-1598 by injecting shell commands into the fltr blur filter. !/usr/bin/env python3 -- coding: utf-8 -- """phpThumb fltr command injection CVE-2010-1598.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

phpThumb - fltr Command Injection Detection (CVE-2010-1598)

Detects CVE-2010-1598 by injecting ;id; into phpThumb.php fltr=blur|... !/usr/bin/env python3 -- coding: utf-8 -- """phpThumb fltr command injection CVE-2010-1598.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

CVE-2005-1898

The passthrough functionality in phpThumb.php in phpThumb before 1.5.4 allows remote attackers to read files that are not images...

EUVD-2012-2890

Malware in sbrugna...

EUVD-2016-1690

Malware in sbrugna...

EUVD-2010-1624

Malware in sbrugna...

EUVD-2005-1900

Malware in sbrugna...

EUVD-2019-1869

Malware in sbrugna...

EUVD-2022-4520

Malicious code in bioql PyPI...

EUVD-2022-2124

Malicious code in bioql PyPI...

EUVD-2025-21154

Malicious code in bioql PyPI...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

Command Injection

Overview james-heinrich/phpthumb is a The PHP thumbnail generator Affected versions of this package are vulnerable to Command Injection via the gifoutputAsJpeg function in phpthumb.gif.php file. An attacker can execute arbitrary operating system commands by supplying a specially crafted parameter...

GHSA-Q745-CFQH-HCRW phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994: Improper Neutralization of Special Elements used in an OS Command

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

The CVE-2025-52994 entry describes an OS Command Injection in phpThumb prior to version 1.7.24, caused by gif_outputAsJpeg in phpthumb.gif.php when given a crafted parameter. Affected versions include 1.7.23 and earlier; the issue is fixed in 1.7.23-202506081709, with advisories indicating upgrad...