CVE-2025-52994
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.
Published Updated
PatchFirst · Latest vulnerabilities
james-heinrich/phpthumb vulnerabilities
Vulnerabilities published for james-heinrich/phpthumb in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 2
CVE-2013-6919
The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.
- Update to 1.7.12
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.