Critical severityNVD Advisory· Published Aug 11, 2025· Updated Apr 15, 2026

CVE-2012-10037

Description

PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/phptax_exec.rbnvd
sourceforge.net/projects/phptax/nvd
www.exploit-db.com/exploits/21665nvd
www.exploit-db.com/exploits/21833nvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.050
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000