CVE-2025-65472
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page.
Risk Assessment
An attacker can trick a logged-in administrator into visiting a malicious page and unknowingly performing actions that lead to administrator account takeover. This results in full control over the application.
Recommendation
Update EasyImages to a version newer than 2.8.6 that includes CSRF protections, or implement anti-CSRF tokens for critical administrative actions.
Other vulnerabilities in EasyImages
See all- CVE-2025-65474Critical
An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
- CVE-2025-65473Critical
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.
- CVE-2025-65471High
An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2023-33599Medium
EasyImages versions ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.
Original NVD description (English source)
A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS