CVE-2005-1898

The passthrough functionality in phpThumb.php in phpThumb before 1.5.4 allows remote attackers to read files that are not images...

EUVD-2012-2890

Malware in sbrugna...

EUVD-2019-1869

Malware in sbrugna...

EUVD-2010-1624

Malware in sbrugna...

EUVD-2016-1690

Malware in sbrugna...

EUVD-2005-1900

Malware in sbrugna...

EUVD-2022-4520

Malicious code in bioql PyPI...

EUVD-2022-2124

Malicious code in bioql PyPI...

EUVD-2025-21154

Malicious code in bioql PyPI...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

Command Injection

Overview james-heinrich/phpthumb is a The PHP thumbnail generator Affected versions of this package are vulnerable to Command Injection via the gifoutputAsJpeg function in phpthumb.gif.php file. An attacker can execute arbitrary operating system commands by supplying a specially crafted parameter...

phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

GHSA-Q745-CFQH-HCRW phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

phpThumb 操作系统命令注入漏洞

phpThumb is a PHP thumbnail generator by the individual developer James Heinrich. An operating system command injection vulnerability exists in phpThumb 1.7.23 and earlier versions, which stems from improper handling of parameter values and can lead to OS command injection...

CVE-2025-52994

The CVE-2025-52994 entry describes an OS Command Injection in phpThumb prior to version 1.7.24, caused by gif_outputAsJpeg in phpthumb.gif.php when given a crafted parameter. Affected versions include 1.7.23 and earlier; the issue is fixed in 1.7.23-202506081709, with advisories indicating upgrad...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

PT-2025-29244 · Phpthumb · Phpthumb

Name of the Vulnerable Software and Affected Versions: phpThumb versions through 1.7.23 Description: The gif outputAsJpeg function in phpThumb through version 1.7.23 allows for OS Command Injection via a crafted parameter value in phpthumb.gif.php. This issue is addressed in version...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...