Log in Start free

Vulnerability · Published Jun 3, 2025 · Assigned by VulDB

CVE-2025-5499slackero phpwcms image_resized.php getimagesize deserialization

High 7.3

In plain English

A high-severity unsafe deserialization in phpwcms from slackero. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.8%top 41.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.

Affected products (as reported)

VendorProductVersions
slackero phpwcms 1.9.01.9.11.9.21.9.31.9.41.9.51.9.61.9.7

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References