CVE-2012-10037: Phptax

Critical severity, CVSS 9.3. EPSS: 1.7% chance of exploitation in the next 30 days.

PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.

Affected products

• Phptax Phptax: version 0.8 only

Published 2025-08-11. Last modified 2026-06-16.