CVE-2021-47904highCWE-434

CVE-2021-47904: falha de alta gravidade em Phreesoft PhreeBooks

PhreeBooks 5.2.3 - Remote Code Execution

Publicada em 23 jan 2026 · Atualizada em 28 jul 2026

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

Phreesoft · PhreeBooks

Referências

https://gist.github.com/joswr1ght/22f40787de19d80d110b37fb79ac3985 https://www.exploit-db.com/exploits/46645 https://www.exploit-db.com/exploits/49524 https://www.phreesoft.com/https://www.vulncheck.com/advisories/phreebooks-remote-code-execution