CVE-2019-5128

10.0

CVSS
Critical

PUBLISHED

A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable...

Exploited in the wild Remote Low complexity No user interaction

Vendor: YouPHPTube
Product: YouPHPTube
Published: Oct 25, 2019
EPSS: —

Description

A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.

php nuclei_scanner

CVSS scores

CVSS v3.0 10.0 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2025-04-27 00:00:00 UTC · Source

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
The Shadowserver (via CIRCL)	Apr 27, 2025

Scanner integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5128.yaml	Jun 02, 2025

Vulnerability detail