CVE-2021-47904: Phreesoft Phreebooks

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.

Affected products

• Phreesoft Phreebooks: version 5.2.3 only

Published 2026-01-23. Last modified 2026-06-17.