Phpthumb (Phpthumb Project) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2025-07-11. Vendor: Phpthumb Project.

CVEs of Phpthumb

• CVE-2025-52994 - CVSS 4.9 (medium), 2025-07-11: gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.
• CVE-2016-10508 - CVSS 6.1 (medium), 2017-08-31: Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters…
• CVE-2013-6919 - CVSS 4.3 (medium), 2014-12-27: The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side…