phpThumb project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

phpThumb project records in CISA KEV

No phpThumb project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phpthumb 2 records LOW

Records

3 records

TI-2016-08550 CVE-2016-10508 · GHSA-6m4h-mpf7-wv84

Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow…

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00831 Published 2017-08-31 No fix listed CWE-79

TI-2025-32999 CVE-2025-52994 · GHSA-q745-cfqh-hcrw

OS command injection in phpThumb

LOW 24

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00678 Published 2025-07-11 No fix listed CWE-78

TI-2013-05684 CVE-2013-6919 · GHSA-3747-gjc9-vvg6

The default configuration of phpThumb before 1.7.12 has a false value for the…

LOW 22

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01191 Published 2014-12-27 Fixed in 1.7.12 CWE-918

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0