PT-2026-27366 · Sourceforge+1 · Phpfilemanager

Murat Kalafatoglu · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2019-25632

Mitre

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm current dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-25632

Produtos afetados

Phpfilemanager

Referências · 4

• 🔥 https://exploit-db.com/exploits/46638 · Exploit
• https://sourceforge.net/projects/phpfm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25632 · Nota de Segurança
• https://vulncheck.com/advisories/phpfilemanager-local-file-inclusion-via-index-php · Nota