CVE-2019-25630 HIGH

CVE-2019-25630: PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager

Vendor Phreesoft
Product PhreeBooks ERP
Weakness CWE-434 · Unrestricted file upload
Published March 24, 2026
Last update March 26, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.

Key dates

02Disclosure timeline

March 24, 2026 CVE published
March 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-0943 SourceCodester Best POS Management System Image save_settings unrestricted upload CVE-2026-11621 Dcat-Admin User Setting upload editorMDUpload unrestricted upload CVE-2026-39591 WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability CVE-2024-9278 HuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted upload CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload