CVE-2019-25647CWE-434

PhreeBooks ERP 5.2.3 Remote Code Execution via Image Manager

High · published March 24, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and execute arbitrary PHP files by bypassing file extension controls. Attackers can upload malicious PHP files through the image manager endpoint and execute them to establish reverse shell connections and execute system commands.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00812 · 56.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-24T11:27Z
EPSS history
Timeline
  • 24 MAR 11:27Z
    PhreeBooks ERP 5.2.3 Remote Code Execution via Image Manager
    cvelistv5