CVE-2019-25578

phpTransformer 2016.9 SQL Injection via GeneratePDF.php

CVSS 8.8 HIGHEPSS 0.4%CWE-89

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

21 mar 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract sensitive database information or manipulate queries.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Phptransformer · phpTransformer

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://phptransformer.com/https://netcologne.dl.sourceforge.net/project/phptransformer/Version%202016.9/release_2016.9.zip https://www.exploit-db.com/exploits/46191 https://www.vulncheck.com/advisories/phptransformer-sql-injection-via-generatepdf-php