CVE-2019-5127
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- January 04, 2019
- Published Date
- October 25, 2019
- Last Updated
- August 04, 2024
- Vendor
- n/a
- Product
- YouPHPTube"
- Description
- A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImage.php is vulnerable to a command injection attack.
CVSS Scores
CVSS v3.0
10.0 - CRITICAL
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
- Score
- 93.07% (Percentile: 99.77%) as of 2025-04-29
Exploit Status
- Exploited in the Wild
- Yes (added 2025-04-25 00:00:00 UTC) Source
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| The Shadowserver (via CIRCL) | 2025-04-25 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5127.yaml | 2025-04-26 00:00:00 UTC |