phpthumb project vulnerabilities

Products

• phpthumb 3

Latest phpthumb project CVEs

Newest publication first

1. CVE-2025-52994 phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

   Published 2025-07-11

   Medium·CVSS 4.9 EPSS 0.68%

   gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

2. CVE-2016-10508 Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.

   Published 2017-08-31

   Medium·CVSS 6.1

   Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.

3. CVE-2013-6919 phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

   Published 2014-12-27

   Medium·CVSS 4.3 EPSS 1.2%

   The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.