CVE-2004-1953: Phprofession

Medium severity, CVSS 5.0. EPSS: 3.3% chance of exploitation in the next 30 days.

phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a PHP error message.

Affected products

• Phprofession Phprofession: version 2.5 only

Published 2004-12-31. Last modified 2026-06-16.