CVE-2019-25709
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Apr 12, 2026
Vendor
unknown
Description
CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/data directory. Attackers can extract delete IDs stored in plaintext from the deserialized database and use them to delete all pictures via the d parameter.