{"id":"CVE-2013-6919","aliases":["EUVD-2022-2124","GHSA-3747-gjc9-vvg6"],"status":"published","title":"phpThumb is vulnerable to Server-Side Request Forgery (SSRF)","description":"The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01191,"percentile":0.68165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2014-12-27T18:00:00Z","modified":"2026-06-17T00:01:07Z","fixes":[{"ecosystem":"Packagist","package":"james-heinrich/phpthumb","fixed_in":["1.7.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"james-heinrich/phpthumb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"james-heinrich/phpthumb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.12"}]}]}],"products":[{"vendor":"phpthumb_project","product":"phpthumb"}],"references":[{"url":"https://github.com/JamesHeinrich/phpThumb/blob/master/docs/phpthumb.changelog.txt","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html","tags":["x_refsource_MISC","x_transferred","Exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6919","tags":["advisory"]},{"url":"https://github.com/JamesHeinrich/phpThumb/commit/457a37d4a22ac9cdbbfe19577376622e58df81b0","tags":["web"]},{"url":"https://github.com/JamesHeinrich/phpThumb/blob/7ee966b38ddd7eb4d8091389aa514604710711c8/docs/phpthumb.changelog.txt#L106","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3747-gjc9-vvg6"},{"url":"https://github.com/JamesHeinrich/phpThumb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-6919","description":"The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.","status":"published","published":"2014-12-27T18:00:00Z","modified":"2024-08-06T17:53:45.383Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2022-2124","description":"The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.","status":"published","published":"2014-12-27T18:00:00Z","modified":"2024-08-06T17:53:45Z","updated_at":"2026-11-03T01:56:24.379982Z"}],"ghsa":[{"id":"GHSA-3747-gjc9-vvg6","title":"phpThumb is vulnerable to Server-Side Request Forgery (SSRF)","description":"The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.","status":"published","published":"2022-05-17T04:19:03Z","modified":"2023-08-29T18:14:01Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2013-6919","description":"The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.","status":"published","published":"2014-12-27T18:59:07.07Z","modified":"2026-06-17T00:01:07.86Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:51.408338Z"}],"osv":[{"id":"GHSA-3747-gjc9-vvg6","title":"phpThumb is vulnerable to Server-Side Request Forgery (SSRF)","description":"The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.","status":"published","published":"2022-05-17T04:19:03Z","modified":"2023-11-08T03:57:27.097492Z","cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}