phpTransformer 2016.9 Flaws Expose Files and Databases to Remote Attack
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 21, 2026
Two vulnerabilities in phpTransformer 2016.9 have been documented, exposing the platform to remote attacks that can disclose sensitive data. CVE-2019-25579 is a directory traversal flaw in the jQueryFileUploadmaster server endpoint that lets unauthenticated attackers read arbitrary files by manipulating a path parameter with traversal sequences such as ../../../../../../. The issue is classified as CWE-22, and the published scoring indicates a high confidentiality impact without corresponding integrity or availability effects.
A second issue, CVE-2019-25578, affects GeneratePDF.php and allows SQL injection through the idnews parameter in crafted GET requests. An attacker could use the flaw to run arbitrary SQL queries, extract database contents, or alter application query behavior. Both CVE records were published with references to Exploit-DB and a VulnCheck advisory, highlighting that phpTransformer 2016.9 contains multiple remotely exploitable weaknesses affecting both file access and backend database security.
