High severity8.8NVD Advisory· Published Mar 24, 2026· Updated Jun 17, 2026
CVE-2019-25630
CVE-2019-25630
Description
PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and execute them via the bizunoFS.php script for remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:phreesoft:phreebookserp:5.2.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phreesoft:phreebookserp:5.2.3:*:*:*:*:*:*:*
- (no CPE)range: 5.2.3
- Range: <5.2.3
Patches
Vulnerability mechanics
References
4- www.exploit-db.com/exploits/46644nvdExploitThird Party AdvisoryVDB Entry
- www.vulncheck.com/advisories/phreebooks-erp-arbitrary-file-upload-via-image-managernvdThird Party Advisory
- sourceforge.net/projects/phreebooks/files/latest/downloadnvdProduct
- www.phreesoft.comnvdProduct
News mentions
0No linked articles in our index yet.