CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2019-25709 — CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and d...

·Source: NIST NVD

Updated:

Executive Summary

CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/data directory. Attackers can extract delete IDs stored in plaintext from the deserialized database and use them to delete all pictures via the d parameter.

Analysis

CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/data directory. Attackers can extract delete IDs stored in plaintext from the deserialized database and use them to delete all pictures via the d parameter. CVSS Score: 9.8. Published: 2026-04-12T13:16:33.950.

Indicators of Compromise (1)

CVE (1)
CVE-2019-25709
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 12, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944)

Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected intermediates have been revoked and blocked by major platform vendors, including Chrome, Mozilla, Apple, [

CVE-2026-111943CVE-2026-111944
Qualys Blog
LOWVulnerability

Analysts Urge US to Follow UK's Lead on Undersea Cable Law

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/analysts-urge-us-to-follow-uks-lead-on-undersea-cable-law-image_small-2-a-33198.jpg" align=right hspace=4><b>UK Proposes Crisis Powers Over Cable Operators and Up to 14 Years for Sabotage</b><br>Security analysts say Washington should update its 1888 undersea cable law after London proposed letting ministers direct cable operators

Bank Info Security
LOWVulnerability

Why HR Belongs at the Center of AI Change

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/hr-belongs-at-center-ai-change-image_small-7-a-33196.jpg" align=right hspace=4><b>Netskope Exec Mike Anderson on Trust, Training and Change Management</b><br>AI adoption can unsettle employees who fear being replaced, even as leaders expect them to use new tools. Netskope CDIO Mike Anderson explains why CIOs should work with HR on

Bank Info Security