Loading story…
Two vulnerabilities in phpTransformer 2016.9 have been documented, exposing the platform to remote attacks that can disclose sensitive data. CVE-2019-25579 is a directory traversal flaw in the jQueryFileUploadmaster server endpoint that lets unauthenticated attackers read arbitrary files by manipulating a path parameter with traversal sequences such as ../../../../../../. The issue is classified as CWE-22, and the published scoring indicates a high confidentiality impact without corresponding integrity or availability effects.
A second issue, CVE-2019-25578, affects GeneratePDF.php and allows SQL injection through the idnews parameter in crafted GET requests. An attacker could use the flaw to run arbitrary SQL queries, extract database contents, or alter application query behavior. Both CVE records were published with references to Exploit-DB and a VulnCheck advisory, highlighting that phpTransformer 2016.9 contains multiple remotely exploitable weaknesses affecting both file access and backend database security.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry documented a directory traversal vulnerability in phpTransformer 2016.9 that allows unauthenticated attackers to access arbitrary files by manipulating the path parameter sent to the jQueryFileUploadmaster endpoint with traversal sequences. The record states it was received by disclosure@vulncheck.com and includes CWE-22 classification, CVSS vectors, and references including Exploit-DB and a VulnCheck advisory.
A CVE entry documented an SQL injection vulnerability in phpTransformer 2016.9 affecting the idnews parameter in GeneratePDF.php, which can be exploited remotely via crafted GET requests. The record states it was received by disclosure@vulncheck.com and includes CVSS scoring, CWE classification, and references to Exploit-DB and a VulnCheck advisory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
High-severity vulnerabilities have been disclosed for **PhreeBooks ERP 5.2.3** and **phpBB**, both allowing authenticated attackers to turn file upload functionality into remote code execution. In **CVE-2019-25630**, an attacker can abuse the `imgFile` parameter in the `bizuno/image/manager` endpoint to upload a malicious PHP file and then execute it through `bizunoFS.php`. The issue affects the Image Manager component in PhreeBooks ERP and was rated high impact under both CVSS v3.1 and v4.0. A separate flaw, **CVE-2019-25685**, affects phpBB and uses `plupload` together with the `phar://` stream wrapper to upload a crafted ZIP archive containing serialized PHP objects. When those objects are later deserialized via the `imagick` parameter in attachment settings, arbitrary code can be executed on the server. References tied to the disclosures include **Exploit-DB** and **VulnCheck**, indicating public technical detail is available for both upload-to-RCE attack paths.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-23697** affects **Vtiger CRM** versions up to **8.3.0**, allowing a low-privileged authenticated user to achieve remote code execution through the **Documents** module. The flaw stems from an incomplete extension denylist in `config.inc.php` that does not block `.phar` files, enabling an attacker to upload a malicious archive containing arbitrary PHP code. The issue is classified as **CWE-434** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`.
Jul 7, 2026
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026