slackero phpwcms image_resized.php getimagesize deserialization

6.9 CVSS

Vulnerability Description

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5499

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Dem0 (VulDB User)

References

More from slackero

View All →

CVE-2025-5498

slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization

Medium 5.1

CVE-2025-5497

slackero phpwcms Feedimport processing.inc.php deserialization

Medium 5.3

CVE-2021-4302

slackero phpwcms SVG File cross site scripting

Low 3.5

CVE-2021-4301

slackero phpwcms sql injection

Medium 6.3

Affected Vendor

slackero

View all reports →

Affected Software

phpwcms

Vulnerable Versions:

1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6, 1.9.7, 1.9.8, 1.9.9, 1.9.10, 1.9.11, 1.9.12, 1.9.13, 1.9.14, 1.9.15, 1.9.16, 1.9.17, 1.9.18, 1.9.19, 1.9.20, 1.9.21, 1.9.22, 1.9.23, 1.9.24, 1.9.25, 1.9.26, 1.9.27, 1.9.28, 1.9.29, 1.9.30, 1.9.31, 1.9.32, 1.9.33, 1.9.34, 1.9.35, 1.9.36, 1.9.37, 1.9.38, 1.9.39, 1.9.40, 1.9.41, 1.9.42, 1.9.43, 1.9.44, 1.9.45, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5, 1.10.6, 1.10.7, 1.10.8