CVE-2019-25709: Codefuture Image Hosting Script

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/data directory. Attackers can extract delete IDs stored in plaintext from the deserialized database and use them to delete all pictures via the d parameter.

Affected products

• Codefuture Image Hosting Script: version 1.6.5 only

Published 2026-04-12. Last modified 2026-06-17.