Loading story…
High-severity vulnerabilities have been disclosed for PhreeBooks ERP 5.2.3 and phpBB, both allowing authenticated attackers to turn file upload functionality into remote code execution. In CVE-2019-25630, an attacker can abuse the imgFile parameter in the bizuno/image/manager endpoint to upload a malicious PHP file and then execute it through bizunoFS.php. The issue affects the Image Manager component in PhreeBooks ERP and was rated high impact under both CVSS v3.1 and v4.0.
A separate flaw, CVE-2019-25685, affects phpBB and uses plupload together with the phar:// stream wrapper to upload a crafted ZIP archive containing serialized PHP objects. When those objects are later deserialized via the imagick parameter in attachment settings, arbitrary code can be executed on the server. References tied to the disclosures include Exploit-DB and VulnCheck, indicating public technical detail is available for both upload-to-RCE attack paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry described an authenticated phpBB vulnerability involving plupload abuse, a crafted ZIP archive, and phar deserialization through attachment settings, enabling remote code execution. The record states the CVE was received by disclosure@vulncheck.com on this date and cites Exploit-DB and VulnCheck references.
A CVE entry documented an authenticated arbitrary file upload vulnerability in PhreeBooks ERP 5.2.3's Image Manager that can lead to remote code execution via uploaded PHP files. The record notes the CVE was received by disclosure@vulncheck.com on this date and references supporting advisories and exploit sources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-23697** affects **Vtiger CRM** versions up to **8.3.0**, allowing a low-privileged authenticated user to achieve remote code execution through the **Documents** module. The flaw stems from an incomplete extension denylist in `config.inc.php` that does not block `.phar` files, enabling an attacker to upload a malicious archive containing arbitrary PHP code. The issue is classified as **CWE-434** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`.
Jul 7, 2026
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through **3.3.16** and **4.0.0-a2**, and stems from trust in the `PHP_AUTH_USER` value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using `login_link` and `auth_provider=apache`, causing phpBB to treat supplied credentials as authenticated under affected configurations. Researchers said compromise of an administrator account can lead to **remote code execution** and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in **3.3.17** and advised users of **4.0.0-a2** to move to the development `master` branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Jun 29, 2026
Researchers detailed how attackers can abuse improperly exposed "protected" method handling in vBulletin to achieve unauthenticated remote code execution on internet-facing forums. The issue affects vBulletin `5.0.0` through `5.7.5` and `6.0.0` through `6.0.3` running on PHP `8.1` or newer, and is tracked as **CVE-2025-48827** and **CVE-2025-48828**. Technical analysis showed the flaws can be chained from remote access to protected method invocation and full code execution on vulnerable servers. CSIRT.SK reported the vulnerabilities are being actively exploited in the wild, with abuse observed since at least May 2025, while many exposed instances remain unpatched. The vendor had reportedly released fixes in April 2024 without detailed public disclosure, leaving administrators unaware of the severity until later reporting. Defenders are being urged to update affected installations to the recommended patched versions or the latest release and to review server and application logs for evidence of compromise.
Jul 24, 2026