What’s Vulnerable › Vulnerabilities

CVE-2019-25630: PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-434

Description

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

Affected products

• Phreesoft PhreeBooks ERP: 5.2.3

References

• https://sourceforge.net/projects/phreebooks/files/latest/download
• https://www.exploit-db.com/exploits/46644
• https://www.phreesoft.com/
• https://www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-manager

Get alerted when CVE-2019-25630 or the next vulnerability affects your stack