What is the CVSS score of EUVD-2025-16733?

EUVD-2025-16733 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by EUVD-2025-16733?

A publicly exploited vulnerability in phpwcms versions up to 1.9.45/1.10.9 allows remote attackers to execute arbitrary code through unsafe deserialization of image file inputs.

Is there a public PoC exploit available for EUVD-2025-16733?

Yes, a public proof-of-concept exploit is available for EUVD-2025-16733. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2025-16733?

Within 24 hours: Inventory all phpwcms installations and verify versions; immediately disable image upload/resizing functionality if possible. Within 7 days: Apply vendor patches (upgrade to v1.9.46 or v1.10.9) or implement compensating controls listed below. Within 30 days: Complete patching of all affected systems and conduct security testing to confirm exploitation did not occur.

PHP EUVD-2025-16733

| CVE-2025-5499 HIGH

Improper Input Validation (CWE-20)

2025-06-03 cna@vuldb.com

Deserialization PHP Phpwcms

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16733

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

PoC Detected

Jan 20, 2026 - 15:46 vuln.today

Public exploit code

CVE Published

Jun 03, 2025 - 14:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.

AnalysisAI

Critical remote code execution vulnerability in slackero phpwcms affecting versions up to 1.9.45 and 1.10.8. The vulnerability exists in the image_resized.php file where unsanitized input to the 'imgfile' parameter is passed to PHP's is_file() and getimagesize() functions, leading to unsafe deserialization. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution with a CVSS score of 7.3; the vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable.

Technical ContextAI

The vulnerability is a CWE-20 (Improper Input Validation) issue affecting the image processing pipeline in phpwcms, a PHP-based content management system. The vulnerable code path processes user-supplied 'imgfile' parameters without proper validation before passing them to PHP's is_file() and getimagesize() functions. The attack surface is the image_resized.php endpoint, which accepts GET/POST parameters. PHP's object deserialization capabilities (unserialize() function or similar) can be triggered through malformed serialized object payloads in the imgfile parameter, potentially leading to gadget chain exploitation. The root cause is insufficient input validation (CWE-20) combined with unsafe use of deserialization functions on user-controllable input, a well-known PHP vulnerability pattern. Affected CPE: cpe:2.3:a:slackero:phpwcms:*:*:*:*:*:*:*:* (versions <=1.9.45 and <=1.10.8 in respective branches).

RemediationAI

Patching: Upgrade phpwcms to version 1.9.46 or 1.10.9 or later; priority: CRITICAL; timeline: Immediate Input Validation: If patching is delayed, implement strict whitelist validation on the 'imgfile' parameter in image_resized.php to reject any serialized PHP object payloads (detect 'O:' pattern in input); priority: HIGH Web Application Firewall: Deploy WAF rules to block POST/GET requests to image_resized.php containing serialized object indicators or encoded payloads; block requests with 'imgfile' parameter containing suspicious characters; priority: HIGH Network Segmentation: If phpwcms instance is internet-facing and unpatched, restrict direct internet access to the web root containing image_resized.php or implement reverse proxy authentication; priority: MEDIUM Monitoring: Enable access logs for image_resized.php and alert on anomalous imgfile parameter values; monitor for POST requests with high entropy or serialized object patterns; priority: MEDIUM