CVE-2025-5499

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-549905.3XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users without admin rights hav CVE-2025-549926.9OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in CVE-2025-549949.3@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is CVE-2025-549956.5Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and inter CVE-2025-549967.2OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-549979.1OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-549985.3OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-549993.7OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-55005.3A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of t CVE-2025-550006.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550016.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550035.7OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In